CVE-2023-45159 : Exploit Details and Defense Strategies

A security vulnerability has been identified in the 1E Client installer, allowing arbitrary file deletion on protected files. Find out the impact, affected systems, and mitigation steps below.

Understanding CVE-2023-45159

This section provides detailed insights into the CVE-2023-45159 vulnerability.

What is CVE-2023-45159?

The CVE-2023-45159 vulnerability lies in the 1E Client installer, enabling arbitrary file deletion on protected files. This can be exploited by a non-privileged user leveraging symbolic links or Windows junctions to target specific directories, subsequently cleared by 1E Client on service startup.

The Impact of CVE-2023-45159

The impact of CVE-2023-45159 is categorized under CAPEC-122 (Privilege Abuse), posing a high threat to confidentiality, integrity, and availability of affected systems.

Technical Details of CVE-2023-45159

Explore the technical aspects of CVE-2023-45159 to better understand the vulnerability.

Vulnerability Description

The 1E Client installer vulnerability allows for arbitrary file deletion on protected files, potentially leading to unauthorized data access and system compromise.

Affected Systems and Versions

The vulnerability affects 1E Client versions less than 8.1.2.62, 8.4.1.159, 9.0.1.88, and 23.7.1.151 when particular conditions are met.

Exploitation Mechanism

By exploiting symbolic links or Windows junctions, non-privileged users can manipulate the installer into deleting protected files, compromising system integrity.

Mitigation and Prevention

Discover the necessary steps to mitigate the CVE-2023-45159 vulnerability and enhance system security.

Immediate Steps to Take

Apply the hotfix applicable to your version:
for v8.1 use hotfix Q23097
for v8.4 use hotfix Q23105
for v9.0 use hotfix Q23115
for SaaS customers, update to 1EClient v23.7 plus hotfix Q23121

Long-Term Security Practices

Implement strict file access controls, monitor symbolic links, and regularly update the 1E Client to prevent potential exploitation.

Patching and Updates

Stay informed about the latest patches and security updates provided by 1E to address CVE-2023-45159 and other vulnerabilities.