Critical vulnerability discovered in Helix Core Server could give full system control to hackers

News
By
published

A vulnerability discovered by Microsoft allows high-privilege remote code execution

Code on screen
(Image credit: Shutterstock)

Four vulnerabilities have been discovered by Microsoft in the Perforce Helix Core Server, with one of them giving the ability for an intruder to remotely execute commands from the ‘LocalSystem’ account.

Helix Core Server offers a single location for storage and access to digital content, often used to store code, and allows an enhanced workflow by providing multiple users access to the same file content and its history.

The software is used by Microsoft’s game developers, and the vulnerabilities were discovered during a security review of the product. It is widely used across a range of other sectors, including government, military, and technology.

 High scores across the board

Three of the vulnerabilities received a CVSS score of 7.5, and involve using either remote commands or RPC header abuse to cause a denial of service (DoS). However, the most dangerous vulnerability received a CVSS score of 9.8 and a ‘critical’ rating, as the vulnerability allows threat actors to execute code remotely as the LocalSystem user.

This is particularly dangerous as the LocalSystem user is primarily used to execute system functions, and has privileged access to system files and other sensitive resources, meaning that if this vulnerability were to be successfully exploited it could surrender complete control of the targeted system.

Moreover, this vulnerability also allows threat actors to install backdoors giving them the opportunity to access systems at a later date to steal sensitive information or plan a ransomware attack.

The full list of vulnerabilities as summarized on the NIST National Vulnerability Database is:

  • CVE-2023-5759 (CVSS score 7.5): Unauthenticated (DoS) via RPC header abuse. 
  • CVE-2023-45849 (CVSS score 9.8): Unauthenticated remote code execution as LocalSystem. 
  • CVE-2023-35767 (CVSS score 7.5): Unauthenticated DoS via remote command. 
  • CVE-2023-45319 (CVSS score 7.5): Unauthenticated DoS via remote command. 

Helix Core Server users can upgrade to the latest version, 2023.1/2513900, to protect themselves from this vulnerability, and Perforce also offered a number of security recommendations in this security guide.

Via BleepingComputer

More from TechRadar Pro

Benedict Collins
Benedict Collins
Staff Writer (Security)

Benedict Collins is a Staff Writer at TechRadar Pro covering privacy and security. Benedict is mainly focused on security issues such as phishing, malware, and cyber criminal activity, but also likes to draw on his knowledge of geopolitics and international relations to understand the motivations and consequences of state-sponsored cyber attacks. Benedict has a MA in Security, Intelligence and Diplomacy, alongside a BA in Politics with Journalism, both from the University of Buckingham.