CVE-2023-37243

Description

The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM when the system reboots. Since the C:\Windows\Temp\Agent.Package.Availability folder inherits permissions from C:\Windows\Temp and Agent.Package.Availability.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.

PUBLISHED Reserved 2023-06-29 | Published 2023-10-31 | Updated 2024-09-05 | Assigner Google

Problem types

CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Product status

Credits

Andrew Oliveau, Mandiant finder

References

github.com/...Disclosures/blob/master/2023/MNDT-2023-0010.md

github.com/...Disclosures/blob/master/2023/MNDT-2023-0010.md

cve.org (CVE-2023-37243)

nvd.nist.gov (CVE-2023-37243)

Download JSON