Strato HiDrive Desktop Client up to 5.0.1.0 on Windows HiDriveMaintenanceService access control

Summaryinfo

A vulnerability described as critical has been identified in Strato HiDrive Desktop Client up to 5.0.1.0 on Windows. Affected by this vulnerability is an unknown functionality of the component HiDriveMaintenanceService. The manipulation results in access control. This vulnerability is cataloged as CVE-2019-9486. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in Strato HiDrive Desktop Client up to 5.0.1.0 on Windows. Affected is an unknown code block of the component HiDriveMaintenanceService. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject and execute code by hijacking the insecure communications with the service. This vulnerability also affects Telekom MagentaCLOUD through 5.7.0.0 and 1&1 Online Storage through 6.1.0.0.

The bug was discovered 04/25/2019. The weakness was shared 04/30/2019. This vulnerability is traded as CVE-2019-9486 since 03/01/2019. It is possible to launch the attack remotely. The requirement for exploitation is a authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/11/2023). The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Affected

• Telekom MagentaCLOUD up to 5.7.0.0
• 1&1 Online Storage up to 6.1.0.0

Productinfo

Vendor

• Strato

Name

• HiDrive Desktop Client

Version

• 5.0.0
• 5.0.1.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion