Vulnerability · Published Aug 7, 2023 · Assigned by GitHub_M

CVE-2023-39520Cryptomator vulnerable to Local Elevation of Privileges

Medium 5.5

In plain English

A medium-severity privilege mismanagement in cryptomator from cryptomator. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.

Affected products (as reported)

Vendor	Product	Versions
cryptomator	cryptomator	<= 1.9.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3 x_refsource_CONFIRM
https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b x_refsource_MISC
https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi x_refsource_MISC
https://github.com/cryptomator/cryptomator/releases/tag/1.9.3 x_refsource_MISC