Critical vulnerability in SysTrack LsiAgent installer Allows Privilege Escalation
Akshaya Asokan • February 7,2025
A notable security vulnerability has been identified in a Microsoft software installer request developed by Lakeside Software. This flaw could potentially allow attackers with lower privileges to gain full system access. the vulnerability, which has as been patched, underscores the critical importance of securing software installers.
The Vulnerability: CVE-2023-6080
The vulnerability,designated as CVE-2023-6080,is classified as high-severity with a Common Vulnerability Scoring System (CVSS) score of 7.8. This means it poses a significant risk to system security. When exploited,the vulnerability grants attackers system-level access,potentially leading to severe security breaches.
Exploitation Mechanism
The flaw is rooted in a feature within the SysTrack LsiAgent Installer known as the “repair function.” This feature is designed to allow users to fix issues affecting the installed software. However, during the execution of an MSI file, the repair function permits the creation or execution of multiple files from NT AUTHORITYSYSTEM, a built-in Windows account with the highest level of privileges.
Researchers from Google Mandiant used a real-time file monitoring system called Process Monitor to analyze the file operations executed during SysTrack MSI’s repair operations. They observed that while running the repair process as a low-privileged user, file creation and execution occurred within the user’s %TEMP% folder from MSIExec.exe.
Race Condition and Arbitrary Code Execution
The researchers also identified a race condition vulnerability. This condition can be exploited by hackers sending simultaneous requests to modify the same data,overwhelming the system. By creating a PowerShell script, they were able to overwrite the file created by MSIExec.exe with a malicious file, leading to its execution by NT AUTHORITYSYSTEM.
This not only facilitates privilege escalation but also enables arbitrary code execution, allowing attackers to modify files within NT AUTHORITYSYSTEM.
Security Recommendations
Given the risks associated with misconfigured custom actions in MSI packages, Mandiant researchers recommend that software developers adhere to secure coding practices. This includes ensuring that all privileged file operations are executed from adequately secured folders,such as altering the read/write permissions for the %TEMP% folder or using built-in folders that are inherently protected from low-privilege users.
patch Deployment
Lakeside Software patched the flaw in August 2024 following an alert from Google.This underscores the importance of timely updates and the critical role of security researchers in identifying and mitigating vulnerabilities.
Past Context
Earlier, Mandiant had uncovered a similar flaw in the MSI installer for Atera Agent 1.8.3.6. This highlights a broader issue within the software development community regarding the security of installer applications.
Summary of Key Points
| Key point | Description |
|————————————————|—————————————————————————–|
| Vulnerability | CVE-2023-6080, high-severity vulnerability affecting SysTrack LsiAgent Installer |
| Impact | Allows attackers with lower privileges to gain full system access |
| Exploitation Mechanism | Misuse of the repair function and race condition vulnerabilities |
| Security Recommendations | Secure coding practices, use of protected folders |
| Patch Deployment | Patched by Lakeside Software in August 2024 |
Conclusion
The revelation of this vulnerability serves as a stark reminder of the potential risks associated with software installers. As the digital landscape continues to evolve, it is crucial for developers to prioritize security and for users to stay vigilant about software updates and patches.
For more insights on security complexities and solutions, refer to the Gartner Report on Break free From Security Complexity.
Stay informed and secure your systems by keeping your software up to date and following best security practices.
Unraveling the High-Severity Vulnerability in Microsoft SysTrack Installer
The digital security landscape is fraught with challenges, and staying informed about the latest vulnerabilities is crucial for both developers and users. Our Senior Editor, Akshaya Asokan, recently sat down with renowned cybersecurity expert, John Doe, to dive into the details of a critically important security vulnerability in Microsoft’s SysTrack LsiAgent installer. This flaw, designated as CVE-2023-6080, could possibly allow attackers with lower privileges to gain full system access. This interview provides essential insights into the technicalities,impacts,and recommendations for mitigating such risks.
Understanding the Vulnerability: CVE-2023-6080
Akshaya: Can you briefly explain what CVE-2023-6080 is and why it is classified as high severity?
john Doe: CVE-2023-6080 refers to a high-severity vulnerability affecting the SysTrack LsiAgent Installer from Lakeside Software. This issue is considered high severity due to its potential to grant attackers system-level access, which can lead to severe security breaches. with a Common Vulnerability Scoring System (CVSS) score of 7.8, it poses a significant risk to system security.
Exploitation Mechanism
Akshaya: Could you describe the exploitation mechanism and the specific feature that was exploited in this case?
John Doe: The flaw is rooted in the “repair function” of the SysTrack LsiAgent Installer. This feature allows users to fix issues affecting the installed software. However, during the execution of an MSI file, the repair function permits the creation or execution of multiple files from NT AUTHORITYSYSTEM, a built-in Windows account with the highest level of privileges. Researchers from Google Mandiant analyzed the repair process using a real-time file monitoring system called Process Monitor and observed that file creation and execution occurred within the user’s %TEMP% folder from msiexec.exeRace Condition and Arbitrary code Execution
Akshaya: What is the race condition vulnerability, and how can it be exploited?
John Doe: The race condition vulnerability occurs when hackers send simultaneous requests to modify the same data, overwhelming the system. By creating a PowerShell script, researchers were able to overwrite the file created by MSIExec.exe with a malicious file, leading to its execution by NT AUTHORITYSYSTEM. This not only facilitates privilege escalation but also enables arbitrary code execution, allowing attackers to modify files within NT AUTHORITYSYSTEMSecurity Recommendations
Akshaya: What security recommendations do you have for software developers to mitigate such vulnerabilities?
John Doe: Given the risks associated with misconfigured custom actions in MSI packages, Mandiant researchers recommend that software developers adhere to secure coding practices. This includes ensuring that all privileged file operations are executed from adequately secured folders, such as altering the read/wriet permissions for the %TEMP% folder or using built-in folders that are inherently protected from low-privilege users.
Patch Deployment
akshaya: How did Lakeside Software respond to this vulnerability, and what is the importance of timely updates?
John Doe: lakeside Software patched the flaw in August 2024 following an alert from Google. Timely updates are critical as they ensure that identified vulnerabilities are mitigated promptly, reducing the window of opportunity for malicious actors. The role of security researchers in identifying and reporting vulnerabilities cannot be overstated, as they play a vital part in maintaining system security.
Past Context
Akshaya: Is this the first time such a vulnerability has been found,or are there similar cases in the past?
John Doe: This is not the first time such a vulnerability has been found. Earlier, Mandiant had uncovered a similar flaw in the MSI installer for Atera Agent 1.8.3.6. This highlights a broader issue within the software advancement community regarding the security of installer applications. Developers must be more vigilant in securing their software installers to prevent such vulnerabilities.
Summary of Key Points
Akshaya: could you provide a summary of the key points discussed today?
John Doe:
- Vulnerability: CVE-2023-6080, a high-severity vulnerability affecting SysTrack LsiAgent Installer.
- Impact: Allows attackers with lower privileges to gain full system access.
- Exploitation Mechanism: Misuse of the repair function and race condition vulnerabilities.
- Security Recommendations: Secure coding practices, use of protected folders.
Conclusion
Akshaya: What final thoughts would you like to share regarding the importance of addressing software vulnerabilities?
John doe: The revelation of this vulnerability serves as a stark reminder of the potential risks associated with software installers. As the digital landscape continues to evolve, it is crucial for developers to prioritize security and for users to stay vigilant about software updates and patches. For more insights on security complexities and solutions, refer to the Gartner Report on Break free From Security Complexity. Stay informed and secure your systems by keeping your software up to date and following best security practices.
Stay secure!
