CVE-2022-23743
📋 TL;DR
CVE-2022-23743 is a local privilege escalation vulnerability in Check Point ZoneAlarm security software. It allows a local attacker to execute arbitrary code with SYSTEM privileges by exploiting weak directory permissions during the upgrade process. This affects users running vulnerable versions of ZoneAlarm on Windows systems.
💻 Affected Systems
- Check Point ZoneAlarm Extreme Security
📦 What is this software?
Zonealarm by Checkpoint
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains SYSTEM privileges, enabling installation of persistent malware, credential theft, and full control over the affected system.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, or access protected system resources.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though local attackers could still attempt exploitation.
🎯 Exploit Status
Exploitation requires local access but is relatively straightforward once local execution is achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.8.200.19118 and v15.8.211.192119
Vendor Advisory: https://www.zonealarm.com/software/extreme-security/release-history
Restart Required: Yes
Instructions:
1. Open ZoneAlarm Extreme Security. 2. Navigate to Settings > Update. 3. Click 'Check for Updates'. 4. Install available updates. 5. Restart the system when prompted.
🔧 Temporary Workarounds
Restrict ProgramData directory permissions
windowsManually set restrictive permissions on the vulnerable directory to prevent unauthorized writes.
icacls "C:\ProgramData\CheckPoint\ZoneAlarm\Data\Updates" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges and prevent unauthorized local execution.
- Monitor for suspicious file writes in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory and alert on unexpected SYSTEM privilege escalations.
🔍 How to Verify
Check if Vulnerable:
Check ZoneAlarm version in the application interface or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\ZoneAlarm\VersionCheck Version:
reg query "HKLM\SOFTWARE\CheckPoint\ZoneAlarm" /v VersionVerify Fix Applied:
Verify ZoneAlarm version is 15.8.200.19118 or higher, or v15.8.211.192119 or higher.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes to ProgramData\CheckPoint\ZoneAlarm\Data\Updates
- Processes spawning with SYSTEM privileges from non-standard locations
- ZoneAlarm upgrade process anomalies
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
EventID=4688 AND NewProcessName="*\ProgramData\CheckPoint\ZoneAlarm\*" AND SubjectUserName!="SYSTEM"