Privilege escalation in Kaspersky VPN Secure Connection

1) Link following

EUVDB-ID: #VU66134

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27535

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure link following when deleting folders via support tools. A local user can create a specially crafted symbolic link to a critical folder on the system and delete it via "Delete service data and reports" feature, which can result in future privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Kaspersky VPN Secure Connection: before 21.7.7.393

CPE2.3

External links

http://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/
http://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.