Critical vulnerability discovered in Helix Core Server could give full system control to hackers

News
By
published

A vulnerability discovered by Microsoft allows high-privilege remote code execution

Code on screen
(Image credit: Shutterstock)

Four vulnerabilities have been discovered by Microsoft in the Perforce Helix Core Server, with one of them giving the ability for an intruder to remotely execute commands from the ‘LocalSystem’ account.

Helix Core Server offers a single location for storage and access to digital content, often used to store code, and allows an enhanced workflow by providing multiple users access to the same file content and its history.

The software is used by Microsoft’s game developers, and the vulnerabilities were discovered during a security review of the product. It is widely used across a range of other sectors, including government, military, and technology.

 High scores across the board

Three of the vulnerabilities received a CVSS score of 7.5, and involve using either remote commands or RPC header abuse to cause a denial of service (DoS). However, the most dangerous vulnerability received a CVSS score of 9.8 and a ‘critical’ rating, as the vulnerability allows threat actors to execute code remotely as the LocalSystem user.

This is particularly dangerous as the LocalSystem user is primarily used to execute system functions, and has privileged access to system files and other sensitive resources, meaning that if this vulnerability were to be successfully exploited it could surrender complete control of the targeted system.

Moreover, this vulnerability also allows threat actors to install backdoors giving them the opportunity to access systems at a later date to steal sensitive information or plan a ransomware attack.

The full list of vulnerabilities as summarized on the NIST National Vulnerability Database is:

  • CVE-2023-5759 (CVSS score 7.5): Unauthenticated (DoS) via RPC header abuse. 
  • CVE-2023-45849 (CVSS score 9.8): Unauthenticated remote code execution as LocalSystem. 
  • CVE-2023-35767 (CVSS score 7.5): Unauthenticated DoS via remote command. 
  • CVE-2023-45319 (CVSS score 7.5): Unauthenticated DoS via remote command. 

Helix Core Server users can upgrade to the latest version, 2023.1/2513900, to protect themselves from this vulnerability, and Perforce also offered a number of security recommendations in this security guide.

Via BleepingComputer

More from TechRadar Pro

TOPICS
Benedict Collins
Benedict Collins
Staff Writer (Security)

Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division),  then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.