CVE-2024-2658: Critical Uncontrolled Search Path Vulnerability in Schneider Electric Floating License Manager
TL;DR
CVE-2024-2658 is a significant vulnerability affecting the FlexNet Publisher within the Schneider Electric Floating License Manager, allowing local non-administrative users to escalate privileges. This flaw can lead to full control over industrial systems, posing a serious risk in environments relying on Schneider Electric solutions.
Main Analysis
Research conducted on CVE-2024-2658 indicates that the vulnerability arises from the FlexNet Publisher component used in Schneider Electric’s Floating License Manager. It falls under the category of an uncontrolled search path element issue, where the software references a hardcoded path to an OpenSSL configuration file without appropriate access controls. Consequently, an attacker with local access can craft a malicious configuration file, which allows the lmadmin.exe service, running under low privileges, to load a rogue DLL. This exploitation path potentially leads to escalation of privileges up to the NT AUTHORITY\SYSTEM level, enabling far-reaching access and control over sensitive data and system processes.
The report investigates how the integration of FlexNet Publisher in Schneider Electric’s licensing structure creates exploitable weaknesses. By detailing the components involved, including the lmadmin.exe service and the OpenSSL configuration file, the analysis reveals how standard Windows NTFS permissions can be manipulated to facilitate the attack. Images provided in the report illustrate the exploit path and highlight the misconfigured service settings that contribute to the vulnerability, emphasizing the risks associated with improper directory permissions.
Defensive Context
Organizations deploying Schneider Electric Floating License Manager need to address this vulnerability, as it presents a substantial risk to operational security. Environments with exposed systems, particularly those containing sensitive automation controls or engineering workstations, are at heightened risk. Organizations without critical dependencies on floating licenses may consider eliminating the software to mitigate exposure.
Why This Matters
The real-world implications of this vulnerability can be severe, leading to unauthorized access and the potential disruption of industrial processes. Facilities that rely on Schneider Electric licensing may find their operations directly affected, necessitating immediate attention to this risk.
Defender Considerations
To address CVE-2024-2658, organizations should upgrade to the patched version of FlexNet Publisher (version 3.0.0.0 or later) and enforce stricter directory access controls, particularly on the C:\cygwin path, to prevent unauthorized modifications. Implementing these measures can significantly reduce the risk of exploitation.
Indicators of Compromise (IOCs)
– Vulnerable component: FlexNet Publisher versions up to and including 11.19.6.0
– Service name: lmadmin.exe
– Malicious configuration file path: C:\cygwin\home\nightly\LMADMI~1.4\tier1\lmadmin\contrib\openssl\_RELEA~1\openssl\openssl.cnf
– Example DLL path: C:\Users\public\malicious.dll
In summary, the vulnerabilities in the Schneider Electric Floating License Manager must be prioritized for immediate remediation to avert potential exploitation.
