Vulnerabilidade de Escalada de Privilégios Local de Travessia de Diretório no Comodo Internet Security Pro

Successful exploitation of CVE-2024-7248 allows a local attacker to bypass security restrictions and gain elevated privileges on the compromised system. This can lead to complete control over the affected machine, including the ability to install malware, access sensitive data, and modify system configurations. The attack leverages the update mechanism, a critical component for maintaining system security, making it a particularly concerning vulnerability. The lack of proper input validation in file operations is the root cause, enabling attackers to craft malicious paths that bypass intended security checks. This vulnerability shares similarities with other directory traversal exploits where attackers manipulate file paths to access unauthorized resources.

Users of Comodo Internet Security Pro, particularly those running versions 12.2.4.8032 through 12.2.4.8032, are at risk. Systems with limited user access controls and those that automatically download and install updates without verification are especially vulnerable. Shared hosting environments utilizing Comodo Internet Security Pro are also at increased risk.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*Comodo*'} | Format-List TaskName, State

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*Comodo*'} | Format-List ProcessName, Id, CPU

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Comodo Internet Security Pro']]]" | Format-List TimeCreated, Message

1. 2024-07-29Disclosure

   disclosure

1. Reservado2024-07-29
2. Publicada2024-07-29
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-7248 is to upgrade to the patched version of Comodo Internet Security Pro as soon as it becomes available. Until the patch is applied, consider disabling automatic updates and manually verifying the integrity of downloaded updates before installation. While a direct workaround is unavailable, restricting user access to the update directory and implementing strict file access controls can help reduce the attack surface. Monitor system logs for unusual file access patterns or attempts to access sensitive files outside of expected locations. After upgrade, confirm the vulnerability is resolved by attempting to trigger the traversal path with a benign test file.