Webroot Antivirus COM-Hijacking LPE

The impact of CVE-2023-7241 is significant due to its potential for privilege escalation and data loss. An attacker who successfully exploits this vulnerability can leverage WRSA.EXE to delete critical system files, application data, or even security logs, effectively crippling the system or masking their malicious activity. This could lead to complete system compromise, data exfiltration, or denial of service. The ability to delete protected files bypasses standard security controls, making this a particularly dangerous vulnerability. The scope of impact extends to any system running the affected versions of Webroot Antivirus.

Organizations using Webroot Antivirus in environments with sensitive data or critical infrastructure are particularly at risk. Systems with legacy configurations or those that haven't been regularly patched are also more vulnerable. Shared hosting environments where multiple users share the same server could potentially be affected if one user's compromised account exploits this vulnerability.

• windows / supply-chain:

Get-Process -Name WRSA | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-WinEvent -LogName Application -Filter "EventID=1001 and Source='Webroot'"

• windows / supply-chain: Check Autoruns for unusual entries related to WRSA.EXE or Webroot Antivirus. • windows / supply-chain: Use Sysinternals Process Monitor to monitor WRSA.EXE's file system activity.

1. 2024-05-01Disclosure

   disclosure

1. Reserviert2024-01-25
2. Veröffentlicht2024-05-01
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2023-7241 is to upgrade Webroot Antivirus to version 9.0.35.17 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider temporarily restricting the permissions of WRSA.EXE to limit its ability to delete files. While not a complete solution, this can reduce the potential impact of exploitation. Monitor system logs for any unusual activity related to WRSA.EXE, particularly file deletion events. After upgrading, confirm the fix by attempting to trigger the vulnerability using a known exploit technique (if available) or by verifying that WRSA.EXE no longer has the ability to delete protected files.