CVE-2024-23458

Executive Summary

CVE-2024-23458 is a local privilege escalation vulnerability in the Zscaler Client Connector for Windows, affecting versions prior to 4.2.0.190. The vulnerability stems from a missing reparse point check during the copying of individual autoupdater log files. This oversight allows an attacker with local access to craft a symbolic link (reparse point) attack, potentially leading to arbitrary file write operations and subsequent privilege escalation. The CVSS score of 7.3 (High) reflects the low attack complexity and the potential for high impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been identified at this time, and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. The vendor has released a patched version (4.2.0.190) to address this issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond local access.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges (e.g., standard user).
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Successful exploitation could lead to full system compromise.
• Integrity (I): High (H) – The attacker can modify system files.
• Availability (A): High (H) – The attacker could cause a denial of service or system instability.

Threat Level: High. The vulnerability is locally exploitable with low privileges and no user interaction, making it a significant risk for enterprise environments where users have local access.

Deep Dive & Mechanics

The vulnerability exists in the autoupdater component of the Zscaler Client Connector. When the autoupdater copies individual log files, it fails to check for reparse points (e.g., symbolic links or junction points). A reparse point is a file system object that redirects file operations to another location. By creating a malicious reparse point in the location where the autoupdater writes log files, an attacker can redirect the file write operation to a target location of their choice, such as a system directory or a privileged file.

Attack Flow:

1. An attacker with low-privileged access to a Windows system identifies the autoupdater log directory (e.g., C:\ProgramData\Zscaler\Zscaler Client Connector\Logs).
2. The attacker creates a symbolic link (reparse point) in that directory, pointing to a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts or a DLL in a system path).
3. When the autoupdater runs (either scheduled or triggered), it attempts to copy a log file to the directory. Due to the missing reparse point check, the write operation follows the symbolic link and overwrites the target file.
4. The attacker can then leverage this arbitrary file write to achieve privilege escalation, for example by overwriting a system DLL or a scheduled task configuration.

Root Cause: The CopyFile or similar API call used by the autoupdater does not validate whether the destination path contains a reparse point. The fix involves adding a check (e.g., using GetFileAttributes with FILE_ATTRIBUTE_REPARSE_POINT flag) before performing the copy operation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No reparse point check
void CopyLogFile(const std::wstring& source, const std::wstring& dest) {
    CopyFile(source.c_str(), dest.c_str(), FALSE);
}

Patched Code (Conceptual):

// Patched: Check for reparse point before copy
bool IsReparsePoint(const std::wstring& path) {
    DWORD attrs = GetFileAttributes(path.c_str());
    return (attrs != INVALID_FILE_ATTRIBUTES) && (attrs & FILE_ATTRIBUTE_REPARSE_POINT);
}

void CopyLogFile(const std::wstring& source, const std::wstring& dest) {
    if (IsReparsePoint(dest)) {
        // Log error and abort
        return;
    }
    CopyFile(source.c_str(), dest.c_str(), FALSE);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 or Windows Server 2016+ with Zscaler Client Connector <4.2.0.190 installed.
• Low-privileged user account (e.g., standard domain user).

Steps:

1. Identify the autoupdater log directory. Typically: C:\ProgramData\Zscaler\Zscaler Client Connector\Logs
2. Create a symbolic link to a target file (e.g., C:\Windows\System32\Tasks\MaliciousTask.xml):

   mklink /J "C:\ProgramData\Zscaler\Zscaler Client Connector\Logs\autoupdater.log" "C:\Windows\System32\Tasks\MaliciousTask.xml"
   

3. Wait for the autoupdater to run (or trigger it manually if possible). The autoupdater will write log content to the target file.
4. If the target is a scheduled task XML, the attacker can inject a task that runs with SYSTEM privileges.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for creation of reparse points (symbolic links/junctions) in the Zscaler log directory.
• Alert on file writes to unexpected locations by the Zscaler autoupdater process.
• Use Sysmon Event ID 7 (Image loaded) and Event ID 11 (FileCreate) to track suspicious activity.

Hunting:

• Search for processes named zscaler-autoupdater.exe or similar that write to paths outside the expected log directory.
• Look for file creation events where the target path contains a reparse point attribute.

Indicators of Compromise (IOCs)

• File System:
  • Reparse points (symbolic links or junctions) in C:\ProgramData\Zscaler\Zscaler Client Connector\Logs\
  • Unexpected files created in system directories (e.g., C:\Windows\System32\Tasks\, C:\Windows\System32\drivers\etc\)
• Process:
  • zscaler-autoupdater.exe (or similar) writing to paths outside its normal scope.
• Registry:
  • Modifications to scheduled tasks or services that could be leveraged for persistence.

Detection Engineering

YARA Rule

rule CVE_2024_23458_Zscaler_ReparsePoint {
    meta:
        description = "Detects reparse points in Zscaler autoupdater log directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-23458"
    strings:
        $reparse = "FILE_ATTRIBUTE_REPARSE_POINT" nocase
        $zscaler_path = "Zscaler\\Zscaler Client Connector\\Logs" nocase
    condition:
        $zscaler_path and $reparse
}

Sigma Rule

title: CVE-2024-23458 - Zscaler Autoupdater Reparse Point Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file writes by Zscaler autoupdater to paths containing reparse points
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23458
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\zscaler-autoupdater.exe'
        TargetFilename|contains: 'Zscaler\Zscaler Client Connector\Logs'
    filter:
        TargetFilename|contains: 'C:\ProgramData\Zscaler\Zscaler Client Connector\Logs'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23458 Zscaler Autoupdater Reparse Point Exploitation"; flow:to_server,established; content:"Zscaler"; content:"autoupdater"; content:"reparse"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Zscaler Client Connector for Windows to version 4.2.0.190 or later.
2. If immediate patching is not possible, restrict write access to the autoupdater log directory to only trusted users (e.g., SYSTEM and Administrators).
3. Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from low-integrity processes.

Long-term Measures:

• Implement application whitelisting to prevent unauthorized executables.
• Regularly audit file system permissions and reparse points in sensitive directories.
• Monitor vendor advisories for additional patches or workarounds.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.