fkie_cve-2024-50592
Vulnerability from fkie_nvd
Published
2024-11-08 13:15
Modified
2025-11-03 23:17
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and their hashes. In addition, instructions to execute binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are copied over to the user writable installation folder (C:\Elefant1). This means that a user can overwrite either "PostESUUpdate.exe" or "Update_OpenJava.exe" in the time frame after the copy and before the execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".
References
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://hasomed.de/produkte/elefant/
551230f0-3615-47bd-b7cc-93e92e730bbfhttps://r.sec-consult.com/hasomed
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2024/Nov/3
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker with local access the to medical office computer can \nescalate his Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \nexploiting a race condition in the Elefant Update Service during the \nrepair or update process.\u00a0When using the repair function, the service queries the server for a \nlist of files and their hashes. In addition, instructions to execute \nbinaries to finalize the repair process are included.\u00a0The executables are executed as \"NT AUTHORITY\\SYSTEM\" after they are \ncopied over to the user writable installation folder (C:\\Elefant1). This\n means that a user can overwrite either \"PostESUUpdate.exe\" or \n\"Update_OpenJava.exe\" in the time frame after the copy and before the \nexecution of the final repair step. The overwritten executable is then executed as \"NT AUTHORITY\\SYSTEM\"."
    },
    {
      "lang": "es",
      "value": "Un atacante con acceso local al equipo del consultorio m\u00e9dico puede escalar sus privilegios de usuario de Windows a \"NT AUTHORITY\\SYSTEM\" explotando una condici\u00f3n de ejecuci\u00f3n en el Servicio de actualizaci\u00f3n de Elefant durante el proceso de reparaci\u00f3n o actualizaci\u00f3n. Al utilizar la funci\u00f3n de reparaci\u00f3n, el servicio consulta al servidor para obtener una lista de archivos y sus hashes. Adem\u00e1s, se incluyen instrucciones para ejecutar binarios para finalizar el proceso de reparaci\u00f3n. Los ejecutables se ejecutan como \"NT AUTHORITY\\SYSTEM\" despu\u00e9s de que se copian a la carpeta de instalaci\u00f3n editable por el usuario (C:\\Elefant1). Esto significa que un usuario puede sobrescribir \"PostESUUpdate.exe\" o \"Update_OpenJava.exe\" en el per\u00edodo de tiempo posterior a la copia y anterior a la ejecuci\u00f3n del paso de reparaci\u00f3n final. El ejecutable sobrescrito se ejecuta entonces como \"NT AUTHORITY\\SYSTEM\"."
    }
  ],
  "id": "CVE-2024-50592",
  "lastModified": "2025-11-03T23:17:14.250",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-08T13:15:03.670",
  "references": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://hasomed.de/produkte/elefant/"
    },
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "url": "https://r.sec-consult.com/hasomed"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2024/Nov/3"
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.