Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability

Successful exploitation of CVE-2024-7248 allows a local attacker to bypass security restrictions and gain elevated privileges on the affected system. This can lead to unauthorized access to sensitive data, modification of system configurations, and potentially complete control over the compromised machine. The attacker needs to have the ability to execute low-privileged code initially. The lack of proper input validation in the update mechanism is the root cause, enabling the attacker to craft malicious file paths that bypass intended security checks. This vulnerability shares similarities with other directory traversal exploits where attackers leverage flawed file handling routines to access restricted resources.

Users of Comodo Internet Security Pro, particularly those running versions 12.2.4.8032 through 12.2.4.8032, are at risk. Systems with limited user access controls and those that automatically download and install updates without verification are especially vulnerable. Shared hosting environments utilizing Comodo Internet Security Pro are also at increased risk.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*Comodo*'} | Format-List TaskName, State

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*Comodo*'} | Format-List ProcessName, Id, CPU

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Comodo Internet Security Pro']]]" | Format-List TimeCreated, Message

1. 2024-07-29Disclosure

   disclosure

1. Reserviert2024-07-29
2. Veröffentlicht2024-07-29
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

Given the lack of a released patch, immediate mitigation strategies are crucial. Restrict access to the Comodo Internet Security Pro installation directory to prevent unauthorized modification of update files. Implement strict file access controls to limit the privileges of the user account running the application. Consider disabling automatic updates until a patch is available and thoroughly vetted. Monitor system logs for suspicious file access attempts and unusual process activity. While a direct WAF rule is unlikely to be effective, network segmentation can limit the blast radius of a successful exploit.