Improper Link Resolution Before File Access ('Link Following') (CWE-59)
This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
The impact of this vulnerability is severe. If exploited, it allows an attacker to escalate privileges to SYSTEM level, effectively giving them complete control over the affected system. This could lead to unauthorized access to sensitive data, installation of malware, modification of system settings, and potential lateral movement within the network. The attacker could execute arbitrary code with the highest privileges, potentially compromising the entire system's security.
One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.
As of the latest information provided, no patch is available for this vulnerability. The vendor (Comodo) has been notified, but there's no indication of a fix being released. The timeline shows that the vulnerability was reported to Xcitium Support team on February 2, 2024, and after several communications, no patch was provided. As of July 12, 2024, the Zero Day Initiative (ZDI) notified the vendor of their intention to publish the case as a 0-day advisory.
Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. Specifically: 1. Limit user privileges: Ensure that users are operating with the least privileges necessary for their tasks. 2. Monitor for suspicious activity: Implement robust logging and monitoring for any attempts to create symbolic links or unexpected file deletions related to the cmdagent executable. 3. Application control: Consider implementing application whitelisting to prevent unauthorized executables from running. 4. Regular system audits: Conduct frequent audits to detect any unauthorized privilege escalations or system modifications. 5. Network segmentation: Isolate systems running Comodo Internet Security Pro to limit potential lateral movement in case of a breach.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2024-7250
Feedly found the first article mentioning CVE-2024-7250. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.4%)