CVE-2018-8411 - Incorrect Authorization

Severity

72%

Complexity

39%

Confidentiality

165%

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

CVSS 3.0 Base Score 7.8. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.2. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C).

Demo Examples

Incorrect Authorization

CWE-863

The following code could be for a medical records application. It displays a record to already authenticated users, confirming the user's authorization using a value stored in a cookie.


               }}setcookie("role", $role, time()+60*60*2);
die("\n");
DisplayMedicalHistory($_POST['patient_ID']);
die("You are not Authorized to view this record\n");

The programmer expects that the cookie will only be set when getRole() succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie. However, the attacker can easily set the "role" cookie to the value "Reader". As a result, the $role variable is "Reader", and getRole() is never invoked. The attacker has bypassed the authorization system.

Overview

Type

Microsoft Windows

First reported 6 years ago

2018-10-10 13:29:00

Last updated 5 years ago

2019-10-03 00:03:00

Affected Software

Microsoft Windows 10 1703

1703

Microsoft Windows 10 1709

1709

Microsoft Windows 10 1803

1803

Microsoft Windows 10 1809

1809

Microsoft Windows Server 2008 Service Pack 2

Microsoft Windows Server 2012

Microsoft Windows Server 2016

Microsoft Windows Server 2016 1709

1709

Microsoft Windows Server 2016 1803

1803

Microsoft Windows Server 2019

References

105508

Third Party Advisory, VDB Entry

1041832