Exploit
CVE-2024-7250

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: Jul 29, 2024 / Updated: 3mo ago

010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard

Summary

This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

Impact

The impact of this vulnerability is severe. If exploited, it allows an attacker to escalate privileges to SYSTEM level, effectively giving them complete control over the affected system. This could lead to unauthorized access to sensitive data, installation of malware, modification of system settings, and potential lateral movement within the network. The attacker could execute arbitrary code with the highest privileges, potentially compromising the entire system's security.

Exploitation

One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, no patch is available for this vulnerability. The vendor (Comodo) has been notified, but there's no indication of a fix being released. The timeline shows that the vulnerability was reported to Xcitium Support team on February 2, 2024, and after several communications, no patch was provided. As of July 12, 2024, the Zero Day Initiative (ZDI) notified the vendor of their intention to publish the case as a 0-day advisory.

Mitigation

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. Specifically: 1. Limit user privileges: Ensure that users are operating with the least privileges necessary for their tasks. 2. Monitor for suspicious activity: Implement robust logging and monitoring for any attempts to create symbolic links or unexpected file deletions related to the cmdagent executable. 3. Application control: Consider implementing application whitelisting to prevent unauthorized executables from running. 4. Regular system audits: Conduct frequent audits to detect any unauthorized privilege escalations or system modifications. 5. Network segmentation: Isolate systems running Comodo Internet Security Pro to limit potential lateral movement in case of a breach.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-7250

Jul 29, 2024 at 10:15 PM
First Article

Feedly found the first article mentioning CVE-2024-7250. See article

Jul 29, 2024 at 10:21 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Jul 29, 2024 at 10:21 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.4%)

Jul 30, 2024 at 10:23 AM
Static CVE Timeline Graph

Affected Systems

Comodo/internet_security
+null more

Exploits

https://www.zerodayinitiative.com/advisories/ZDI-24-955/
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-132: Symlink Attack
+null more

Vendor Advisory

ZDI-24-955: (0Day) Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-7250.

References

CVE-2024-7250
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was...
CVE-2024-7250
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22829.

News

CVE-2024-7250 | Comodo Internet Security Pro 12.2.4.8032 link following (ZDI-24-955)
A vulnerability, which was classified as critical , was found in Comodo Internet Security Pro 12.2.4.8032 . Affected is an unknown function. The manipulation leads to link following. This vulnerability is traded as CVE-2024-7250 . Attacking locally is a requirement. There is no exploit available.
NA - CVE-2024-7250 - Comodo Internet Security Pro cmdagent Link...
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo...
CVE-2024-7250
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVE-2024-7250 - Comodo Internet Security Pro cmdagent Local Privilege Escalation Vulnerability
CVE ID : CVE-2024-7250 Published : July 29, 2024, 10:15 p.m. 21 minutes ago Description : Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file.
CVE-2024-7250
Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was...
See 4 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI