CVE-2024-12363

Executive Summary

CVE-2024-12363 is a local privilege escalation vulnerability in the TeamViewer Patch & Asset Management component (part of TeamViewer Remote Management) on Windows. The flaw stems from insufficient permissions, allowing a local authenticated user to delete arbitrary files on the system. This can lead to denial of service, data loss, or potentially be leveraged for further exploitation. The vulnerability affects versions prior to 24.12. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the widespread use of TeamViewer, this vulnerability poses a significant risk to enterprise environments.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a valid local user account.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: High (I:H) – Arbitrary file deletion can corrupt system files.
• Availability Impact: High (A:H) – Deletion of critical files can cause denial of service.

Threat Level: High. While local access is required, the low complexity and high impact make it a serious concern for multi-user systems or environments where attackers have already gained a foothold.

Deep Dive & Mechanics

The vulnerability exists in the TeamViewer Patch & Asset Management component, which runs with elevated privileges to manage software updates and inventory. Due to insufficient permission checks, a local authenticated user can exploit the component’s file operations to delete arbitrary files, including system files or other users’ data.

Root Cause: The component does not properly validate the target path when performing file deletion operations. A low-privileged user can call the vulnerable API or trigger the component to delete files outside the intended scope (e.g., C:\Windows\System32\config\SAM).

Attack Scenario:

1. An attacker gains local access to a Windows machine (e.g., via phishing, credential theft, or physical access).
2. The attacker identifies the TeamViewer Patch & Asset Management service running with SYSTEM privileges.
3. Using a crafted request or script, the attacker triggers the vulnerable component to delete a critical system file (e.g., ntoskrnl.exe or SAM).
4. The system becomes unstable or crashes, leading to denial of service. Alternatively, the attacker could delete security logs or other evidence.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-24.12):

// Pseudocode for vulnerable file deletion
public void DeleteFile(string path)
{
    // No permission check on the path
    File.Delete(path); // Attacker can pass any path
}

Patched Code (24.12+):

// Pseudocode for patched file deletion
public void DeleteFile(string path)
{
    // Validate that the path is within allowed directories
    if (!path.StartsWith(AllowedBasePath, StringComparison.OrdinalIgnoreCase))
    {
        throw new UnauthorizedAccessException("Access denied.");
    }
    File.Delete(path);
}

The patch adds a path validation check to ensure that deletion operations are restricted to the component’s designated working directory (e.g., C:\ProgramData\TeamViewer\PatchManagement).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows machine with TeamViewer Patch & Asset Management < 24.12.
• A low-privileged user account.

Exploitation Steps:

1. Identify the TeamViewer Patch & Asset Management service (e.g., TeamViewer_PatchManagement.exe).
2. Use a tool like Process Monitor to observe file operations.
3. Craft a script to call the vulnerable API (e.g., via COM or named pipe).
4. Execute the script to delete a non-critical test file first (e.g., C:\Temp\test.txt).
5. Escalate to delete a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts).

Example Script (PowerShell):

# Hypothetical exploit - adjust based on actual API
$service = Get-Service -Name "TeamViewerPatchManagement"
$service.Stop()
# Trigger file deletion via vulnerable component
[System.IO.File]::Delete("C:\Windows\System32\drivers\etc\hosts")

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual file deletion events, especially from the TeamViewer process.
• Use Sysmon Event ID 23 (File Delete) to log deletions.
• Alert on deletion of critical system files (e.g., *.exe, *.dll, SAM, SYSTEM).

Hunting:

• Search for TeamViewer_PatchManagement.exe creating or deleting files outside C:\ProgramData\TeamViewer\PatchManagement\.
• Look for processes spawned by TeamViewer that perform file deletions.

Mitigation:

• Apply the patch immediately (upgrade to version 24.12+).
• Restrict local user permissions via Group Policy.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted processes from deleting system files.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\TeamViewer\PatchManagement\* (legitimate)
  • C:\Windows\System32\config\SAM (target)
  • C:\Windows\System32\drivers\etc\hosts (target)
• Process Names:
  • TeamViewer_PatchManagement.exe
• Event Logs:
  • Windows Security Event ID 4663 (An attempt was made to access an object)
  • Sysmon Event ID 23 (File Delete)
• Registry Keys:
  • HKLM\SOFTWARE\TeamViewer\PatchManagement (version info)

Detection Engineering

YARA Rule

rule CVE_2024_12363_TeamViewer_File_Delete
{
    meta:
        description = "Detects TeamViewer Patch & Asset Management component attempting to delete arbitrary files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12363"
    strings:
        $s1 = "TeamViewer_PatchManagement.exe" ascii wide nocase
        $s2 = "DeleteFile" ascii wide nocase
        $s3 = "C:\\Windows\\System32" ascii wide nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: CVE-2024-12363 - TeamViewer Patch & Asset Management Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file deletion events from TeamViewer Patch & Asset Management component targeting system paths
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12363
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 23
        Image|endswith: '\\TeamViewer_PatchManagement.exe'
        TargetFilename|contains: 'C:\\Windows\\System32'
    condition: selection
falsepositives:
    - Legitimate patching operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12363 - TeamViewer Patch & Asset Management Exploit Attempt"; flow:to_server,established; content:"TeamViewer_PatchManagement"; nocase; content:"DeleteFile"; nocase; content:"C:\\Windows\\System32"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade TeamViewer Patch & Asset Management to version 24.12 or later.
2. Workaround: If patching is not possible, restrict local user permissions and disable the Patch & Asset Management component if not needed.
3. Monitoring: Enable detailed logging for file deletion events and monitor for anomalous behavior from TeamViewer processes.
4. Hardening: Apply the principle of least privilege to all local user accounts. Use Windows Defender ASR rules to block untrusted processes from deleting system files.
5. Validation: After patching, verify the version number in the TeamViewer client or via the registry key HKLM\SOFTWARE\TeamViewer\PatchManagement\Version.

Valters IT
Securing Digital Frontiers