CVE-2022-30170
published 2022-09-13CVE-2022-30170: Windows Credential Roaming Service Elevation of Privilege Vulnerability
PriorityP276high7.3CVSS 3.1
AVLACLPRLUIRSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.51%
71.8th percentile
Windows Credential Roaming Service Elevation of Privilege Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19444 | 10.0.10240.19444 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2006 | 10.0.19042.2006 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2006 | 10.0.19043.2006 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2006 | 10.0.19044.2006 |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.978 | 10.0.22000.978 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26115 | 6.1.7601.26115 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21666 | 6.0.6003.21666 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23865 | 6.2.9200.23865 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20571 | 6.3.9600.20571 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5356 | 10.0.14393.5356 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.3406 | 10.0.17763.3406 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1006 | 10.0.20348.1006 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploitation requires a user to log in to Windows; monitor for unexpected remote interactive logon (RDP/interactive) sessions on machines where the victim account would not normally hold such privilege ↗
- →Alert on privilege escalation resulting in remote interactive logon rights being granted to accounts that do not normally hold such privilege on the target machine ↗
- ·Exploitation is assessed as 'Less Likely' for both latest and older software releases; no public exploit or in-the-wild exploitation confirmed at time of advisory ↗
- ·User interaction is required for exploitation — the victim must actively log in to Windows, limiting fully automated attack chains ↗
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
ghsa7.3HIGH
osv7.3HIGH
vulncheck7.3HIGH
vendor_msrc7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
DSInternals Credential Roaming Elevation of Privilege Vulnerability
ghsa·2022-12-06·CVSS 7.3
[HIGH] DSInternals Credential Roaming Elevation of Privilege Vulnerability
DSInternals Credential Roaming Elevation of Privilege Vulnerability
### Impact
A vulnerability exists in the `DSInternals.Common.Data.RoamedCredential.Save()` method, which incorrectly parses the `msPKIAccountCredentials` LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges.
A [similar security issue](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30170) used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows.
### Exploitability
The vulnerability can be exploited under the following circumstances:
- An attacker is able to modify the `msPKIAccountCredentials` a
OSV
DSInternals Credential Roaming Elevation of Privilege Vulnerability
osv·2022-12-06·CVSS 7.3
[HIGH] DSInternals Credential Roaming Elevation of Privilege Vulnerability
DSInternals Credential Roaming Elevation of Privilege Vulnerability
### Impact
A vulnerability exists in the `DSInternals.Common.Data.RoamedCredential.Save()` method, which incorrectly parses the `msPKIAccountCredentials` LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges.
A [similar security issue](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30170) used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows.
### Exploitability
The vulnerability can be exploited under the following circumstances:
- An attacker is able to modify the `msPKIAccountCredentials` a
GHSA
GHSA-7f9r-4pwc-55x7: Windows Credential Roaming Service Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-09-14
CVE-2022-30170 [HIGH] GHSA-7f9r-4pwc-55x7: Windows Credential Roaming Service Elevation of Privilege Vulnerability
Windows Credential Roaming Service Elevation of Privilege Vulnerability.
VulnCheck
Windows Credential Roaming Service Elevation of Privilege Vulnerability
vulncheck·2022·CVSS 7.3
CVE-2022-30170 [HIGH] Windows Credential Roaming Service Elevation of Privilege Vulnerability
Windows Credential Roaming Service Elevation of Privilege Vulnerability
Windows Credential Roaming Service Elevation of Privilege Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cloud.google.com/blog/topics/threat-intelligence/apt29-windows-credential-roaming/
Microsoft
Windows Credential Roaming Service Elevation of Privilege Vulnerability
vendor_msrc·2022-09-13·CVSS 7.3
CVE-2022-30170 [HIGH] Windows Credential Roaming Service Elevation of Privilege Vulnerability
Windows Credential Roaming Service Elevation of Privilege Vulnerability
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user to log in to Windows.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited the vulnerability could gain remote interactive logon rights to a machine where the victim's account would not normally hold such privilege.
Windows Credential Roaming Service: Windows Credential Roaming Service
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Like
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-13
Published
Exploited in the wild