CVE-2021-45492
📋 TL;DR
This vulnerability allows unprivileged users to escalate privileges to SYSTEM via DLL search-order hijacking in Sage 300 ERP. The installer places a writable directory in the system PATH, enabling attackers to plant malicious DLLs that get executed with elevated privileges. Organizations using Sage 300 ERP installed in C:\Sage with default permissions are affected.
💻 Affected Systems
- Sage 300 ERP (formerly Accpac)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege escalation leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation from standard user to SYSTEM, enabling installation of malware, credential harvesting, and lateral movement.
If Mitigated
Limited impact with proper directory permissions and PATH management, restricting local privilege escalation attempts.
🎯 Exploit Status
Requires local user access but exploitation is straightforward once access is obtained. DLL hijacking is a well-known technique with available tooling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
No official patch identified. Follow workarounds to secure directory permissions and modify PATH variable.
🔧 Temporary Workarounds
Secure Directory Permissions
windowsRemove write permissions for unprivileged users on C:\Sage\Sage300\Runtime directory
icacls "C:\Sage\Sage300\Runtime" /inheritance:r
icacls "C:\Sage\Sage300\Runtime" /grant Administrators:(OI)(CI)F
icacls "C:\Sage\Sage300\Runtime" /grant SYSTEM:(OI)(CI)F
Remove Vulnerable PATH Entry
windowsRemove C:\Sage\Sage300\Runtime from system PATH variable
setx /M PATH "%PATH:C:\Sage\Sage300\Runtime;=%"
🧯 If You Can't Patch
- Move installation to %PROGRAMFILES(X86)% directory structure to inherit proper permissions
- Implement strict access controls and monitoring on affected systems
🔍 How to Verify
Check if Vulnerable:
Check if C:\Sage\Sage300\Runtime exists and verify permissions with: icacls "C:\Sage\Sage300\Runtime"Check Version:
Check Sage 300 version through application interface or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Sage\Sage 300Verify Fix Applied:
Verify directory permissions no longer allow write access to Users group and PATH no longer contains vulnerable directory📡 Detection & Monitoring
Log Indicators:
- Unexpected DLL loads from C:\Sage\Sage300\Runtime
- Process creation events showing privilege escalation patterns
- Windows Event Logs showing service manipulation
Network Indicators:
- Unusual outbound connections from Sage services
- Lateral movement attempts from affected systems
SIEM Query:
Process creation where parent process is Sage* and command line contains suspicious DLL paths