CVE-2022-26526
📋 TL;DR
This vulnerability allows local users to escalate privileges by placing malicious executable files in a world-writable directory that gets added to the system PATH during Anaconda/Miniconda installation. It affects users who performed non-default installations for 'all users' with PATH modification enabled.
💻 Affected Systems
- Anaconda3
- Miniconda3
📦 What is this software?
Anaconda3 by Anaconda
⚠️ Risk & Real-World Impact
Worst Case
Local attackers gain SYSTEM/root privileges by planting Trojan horse executables that get executed with elevated permissions.
Likely Case
Malicious local users or malware with user-level access escalate to administrative privileges on affected systems.
If Mitigated
No impact if installations use default settings or don't modify system PATH.
🎯 Exploit Status
Exploitation requires local user access and knowledge of the vulnerable directory location. Proof of concept details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Anaconda3 2022.05+, Miniconda3 4.12.0+
Vendor Advisory: https://github.com/continuumio/anaconda-issues/issues
Restart Required: No
Instructions:
1. Update to latest Anaconda3 (2022.05+) or Miniconda3 (4.12.0+). 2. Run installer with administrative privileges. 3. Remove old vulnerable directory from PATH if present.
🔧 Temporary Workarounds
Remove vulnerable directory from PATH
windowsRemove the world-writable Anaconda directory from system PATH environment variable
Remove C:\ProgramData\Anaconda3\Scripts or similar from system PATH via System Properties > Advanced > Environment Variables
Restrict directory permissions
windowsChange permissions on the vulnerable directory to prevent unauthorized writes
icacls "C:\ProgramData\Anaconda3\Scripts" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
🧯 If You Can't Patch
- Remove the vulnerable Anaconda directory from system PATH environment variable
- Set restrictive permissions on C:\ProgramData\Anaconda3\Scripts directory to prevent unauthorized writes
🔍 How to Verify
Check if Vulnerable:
Check if C:\ProgramData\Anaconda3\Scripts or similar directory exists and has world-writable permissions, and is in system PATHCheck Version:
conda --versionVerify Fix Applied:
Verify directory permissions are restricted and PATH no longer contains vulnerable directory after update📡 Detection & Monitoring
Log Indicators:
- Unexpected executable creation in Anaconda Scripts directory
- Process execution from C:\ProgramData\Anaconda3\Scripts with elevated privileges
Network Indicators:
- None - local privilege escalation only
SIEM Query:
Process creation where ImagePath contains 'ProgramData\\Anaconda3\\Scripts' AND IntegrityLevel >= High🔗 References
- https://docs.conda.io/en/latest/miniconda.html
- https://github.com/continuumio/anaconda-issues/issues
- https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3
- https://repo.anaconda.com/miniconda/
- https://docs.conda.io/en/latest/miniconda.html
- https://github.com/continuumio/anaconda-issues/issues
- https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3
- https://repo.anaconda.com/miniconda/
