FastTrack Admin By Request 6.1.0.0 AdminByRequest.exe Named Pipe privileges management

Summaryinfo

A vulnerability identified as critical has been detected in FastTrack Admin By Request 6.1.0.0. The impacted element is an unknown function of the file AdminByRequest.exe. Performing a manipulation as part of Named Pipe results in privileges management. This vulnerability is reported as CVE-2019-17201. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in FastTrack Admin By Request 6.1.0.0. This affects some unknown functionality of the file AdminByRequest.exe. The manipulation as part of a Named Pipe leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service (Audckq32.exe) using a .NET named pipe. If the underlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communication with the underlying service and requests elevation. This elevation request has no local checks in the service, and depends on client-side validation in the AdminByRequest.exe interface, i.e., it is a vulnerable exposed functionality in the service. By communicating directly with the underlying service, any user can request elevation and obtain Administrator privilege regardless of group policies or permissions.

The weakness was disclosed 01/23/2020 (Website). The advisory is shared at improsec.com. This vulnerability is uniquely identified as CVE-2019-17201 since 10/05/2019. An attack has to be approached locally. A authentication is required for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-149278 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• FastTrack

Name

• Admin By Request

Version

• 6.1.0.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion