CVE-2022-24138
📋 TL;DR
This vulnerability allows low-privileged users to replace legitimate IOBit software components with malicious executables during the download process, enabling privilege escalation to administrator level. It affects users of IOBit Advanced System Care 15 and Action Download Center on Windows systems where multiple users share the same computer.
💻 Affected Systems
- IOBit Advanced System Care
- IOBit Action Download Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control of the system, enabling installation of persistent malware, data theft, or complete system compromise.
Likely Case
Local privilege escalation allowing attackers to bypass security controls and execute arbitrary code with elevated privileges.
If Mitigated
Limited impact if proper access controls restrict low-privileged users from accessing ProgramData folder or if software runs with minimal privileges.
🎯 Exploit Status
Exploit requires local access and knowledge of SetOpLock technique. Proof of concept code is publicly available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check IOBit website for security updates. Uninstall affected software if no patch is available.
🔧 Temporary Workarounds
Restrict ProgramData Folder Permissions
windowsModify NTFS permissions on ProgramData folder to prevent low-privileged users from writing or modifying files.
icacls "C:\ProgramData" /deny "Users":(OI)(CI)W
Remove Vulnerable Software
windowsUninstall IOBit Advanced System Care 15 and Action Download Center from affected systems.
Control Panel > Programs > Uninstall a program
🧯 If You Can't Patch
- Implement strict access controls on shared systems to prevent low-privileged users from executing arbitrary code
- Monitor ProgramData folder for unauthorized file modifications using file integrity monitoring tools
🔍 How to Verify
Check if Vulnerable:
Check if IOBit Advanced System Care 15 or Action Download Center is installed and verify ProgramData folder permissions allow low-privileged users write access.Check Version:
Check installed programs in Control Panel or run: wmic product where "name like '%IOBit%'" get name,versionVerify Fix Applied:
Verify ProgramData folder permissions deny write access to low-privileged users and affected software is removed or updated.📡 Detection & Monitoring
Log Indicators:
- File creation/modification events in ProgramData folder by low-privileged users
- Process creation events showing privilege escalation patterns
Network Indicators:
- Unusual outbound connections from IOBit processes
- Downloads to ProgramData folder from untrusted sources
SIEM Query:
EventID=4688 AND NewProcessName LIKE '%asc.exe%' AND SubjectUserName NOT IN (admin_users_list)