CVE-2024-50590

{"id": "CVE-2024-50590", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-11-08T12:15:14.820", "references": [{"url": "https://hasomed.de/produkte/elefant/", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/hasomed", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2024/Nov/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-250"}, {"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Attackers with local access to the medical office computer can \nescalate their Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \noverwriting one of two Elefant service binaries with weak permissions.\u00a0The default installation directory of Elefant is \"C:\\Elefant1\" which is \nwritable for all users. In addition, the Elefant installer registers two\n Firebird database services which are running as \u201cNT AUTHORITY\\SYSTEM\u201d.\u00a0\n\nPath: C:\\Elefant1\\Firebird_2\\bin\\fbserver.exe\n\nPath: C:\\Elefant1\\Firebird_2\\bin\\fbguard.exe\n\n\nBoth service binaries are user writable. This means that a local \nattacker can rename one of the service binaries, replace the service \nexecutable with a new executable, and then restart the system. Once the \nsystem has rebooted, the new service binary is executed as \"NT \nAUTHORITY\\SYSTEM\"."}, {"lang": "es", "value": "Los atacantes con acceso local al equipo del consultorio m\u00e9dico pueden escalar sus privilegios de usuario de Windows a \"NT AUTHORITY\\SYSTEM\" sobrescribiendo uno de los dos binarios de servicio de Elefant con permisos d\u00e9biles. El directorio de instalaci\u00f3n predeterminado de Elefant es \"C:\\Elefant1\", que es escribible para todos los usuarios. Adem\u00e1s, el instalador de Elefant registra dos servicios de base de datos de Firebird que se ejecutan como \"NT AUTHORITY\\SYSTEM\". Ruta: C:\\Elefant1\\Firebird_2\\bin\\fbserver.exe Ruta: C:\\Elefant1\\Firebird_2\\bin\\fbguard.exe Ambos binarios de servicio son escribibles por el usuario. Esto significa que un atacante local puede cambiar el nombre de uno de los binarios de servicio, reemplazar el ejecutable de servicio con un nuevo ejecutable y luego reiniciar el sistema. Una vez que el sistema se ha reiniciado, el nuevo binario de servicio se ejecuta como \"NT AUTHORITY\\SYSTEM\"."}], "lastModified": "2025-11-03T23:17:13.780", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}