Vulnerability · Published Oct 20, 2020 · Assigned by GitHub_M

CVE-2020-15264Privilege Escalation in Boxstarter

High 8.0

In plain English

A high-severity security flaw in boxstarter from chocolatey. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)1.6%top 24.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0

Affected products (as reported)

Vendor	Product	Versions
chocolatey	boxstarter	< 2.13.0

Weakness: CWE-668, CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf x_refsource_CONFIRM
https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633 x_refsource_MISC
VU#208577 third-party-advisory, x_refsource_CERT-VN