CVE-2023-22818 - Vulnerability Details - OpenCVE

Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for
Windows that could allow attackers with local access to execute arbitrary code by executing the installer
in the same folder as the malicious DLL. This can lead to the execution of arbitrary
code with the privileges of the vulnerable application or obtain a certain level of persistence
on the compromised host.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00021.

Key SSVC decision points have not yet been added.

Vendors	Products
Westerndigital	Sandisk Security Installer

Configuration 1 [-]

cpe:2.3:a:westerndigital:sandisk_security_installer:*:*:*:*:*:windows:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-26930	Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to execute arbitrary code by executing the installer in the same folder as the malicious DLL. This can lead to the execution of arbitrary code with the privileges of the vulnerable application or obtain a certain level of persistence on the compromised host.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://vuldb.com/?id.245601
https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25

History

No history.

MITRE

Status: PUBLISHED

Assigner: WDC PSIRT

Published: 2023-11-15T20:03:57.085Z

Updated: 2024-08-29T17:35:18.339Z

Reserved: 2023-01-06T20:23:44.301Z

Link: CVE-2023-22818

Vulnrichment

Updated: 2024-08-02T10:20:30.831Z

NVD

Status : Modified

Published: 2023-11-15T20:15:07.157

Modified: 2024-11-21T07:45:28.767

Link: CVE-2023-22818

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22818", "assignerOrgId": "cb3b742e-5145-4748-b44b-5ffd45bf3b6a", "state": "PUBLISHED", "assignerShortName": "WDC PSIRT", "dateReserved": "2023-01-06T20:23:44.301Z", "datePublished": "2023-11-15T20:03:57.085Z", "dateUpdated": "2024-08-29T17:35:18.339Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "SanDisk Security Installer for Windows", "vendor": "SanDisk", "versions": [{"lessThan": "1.0.0.25", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Western Digital would like to thank Alexander Huaman Jaimes for reporting this issue"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for\nWindows that could allow attackers with local access to execute arbitrary code by executing the installer\nin the same folder as the malicious DLL. This can lead to the execution of arbitrary\ncode with the privileges of the vulnerable application or obtain a certain level of persistence\non the compromised host. "}], "value": "Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for\nWindows that could allow attackers with local access to execute arbitrary code by executing the installer\nin the same folder as the malicious DLL.\u00a0This can lead to the execution of arbitrary\ncode with the privileges of the vulnerable application or obtain a certain level of persistence\non the compromised host.\u00a0"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cb3b742e-5145-4748-b44b-5ffd45bf3b6a", "shortName": "WDC PSIRT", "dateUpdated": "2023-11-15T20:03:57.085Z"}, "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25"}], "source": {"discovery": "EXTERNAL"}, "title": "Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows ", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:20:30.831Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-29T17:34:33.570193Z", "id": "CVE-2023-22818", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T17:35:18.339Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:20:30.831Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-29T17:34:33.570193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-29T17:35:12.791Z"}}], "cna": {"title": "Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows ", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Western Digital would like to thank Alexander Huaman Jaimes for reporting this issue"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SanDisk", "product": "SanDisk Security Installer for Windows", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.0.25", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for\nWindows that could allow attackers with local access to execute arbitrary code by executing the installer\nin the same folder as the malicious DLL.\u00a0This can lead to the execution of arbitrary\ncode with the privileges of the vulnerable application or obtain a certain level of persistence\non the compromised host.\u00a0", "supportingMedia": [{"type": "text/html", "value": "Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for\nWindows that could allow attackers with local access to execute arbitrary code by executing the installer\nin the same folder as the malicious DLL. This can lead to the execution of arbitrary\ncode with the privileges of the vulnerable application or obtain a certain level of persistence\non the compromised host. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "cb3b742e-5145-4748-b44b-5ffd45bf3b6a", "shortName": "WDC PSIRT", "dateUpdated": "2023-11-15T20:03:57.085Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22818", "state": "PUBLISHED", "dateUpdated": "2024-08-29T17:35:18.339Z", "dateReserved": "2023-01-06T20:23:44.301Z", "assignerOrgId": "cb3b742e-5145-4748-b44b-5ffd45bf3b6a", "datePublished": "2023-11-15T20:03:57.085Z", "assignerShortName": "WDC PSIRT"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:westerndigital:sandisk_security_installer:*:*:*:*:*:windows:*:*", "matchCriteriaId": "FC7AE34A-B047-491B-8B84-B0389A48074E", "versionEndExcluding": "1.0.0.25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for\nWindows that could allow attackers with local access to execute arbitrary code by executing the installer\nin the same folder as the malicious DLL.\u00a0This can lead to the execution of arbitrary\ncode with the privileges of the vulnerable application or obtain a certain level of persistence\non the compromised host.\u00a0"}, {"lang": "es", "value": "Se abordaron vulnerabilidades de Multiple DLL Search Order Hijack en SanDisk Security Installer para Windows que podr\u00edan permitir a atacantes con acceso local ejecutar c\u00f3digo arbitrario ejecutando el instalador en la misma carpeta que la DLL maliciosa. Esto puede llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios de la aplicaci\u00f3n vulnerable u obtener un cierto nivel de persistencia en el host comprometido."}], "id": "CVE-2023-22818", "lastModified": "2024-11-21T07:45:28.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "psirt@wdc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-15T20:15:07.157", "references": [{"source": "psirt@wdc.com", "tags": ["Broken Link"], "url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25"}, {"source": "nvd@nist.gov", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.245601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://www.westerndigital.com/support/product-security/wdc-23013-sandisk-security-installer-for-windows-1-0-0-25"}], "sourceIdentifier": "psirt@wdc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "psirt@wdc.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}