CVE-2023-26077
📋 TL;DR
The Atera Agent on Windows creates temporary files in directories with insecure permissions, allowing local attackers to write arbitrary files. This affects Windows systems running Atera Agent version 1.8.3.6 and earlier.
💻 Affected Systems
- Atera Agent
📦 What is this software?
Atera by Atera
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM or arbitrary code execution by writing malicious files to sensitive locations.
Likely Case
Local attackers could write files to gain persistence, escalate privileges, or disrupt system operations.
If Mitigated
Limited impact if proper file permissions and user access controls are enforced.
🎯 Exploit Status
Requires local access to the system. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.3.7 or later
Vendor Advisory: https://www.atera.com
Restart Required: Yes
Instructions:
1. Update Atera Agent to version 1.8.3.7 or later. 2. Restart the system or service to apply changes.
🔧 Temporary Workarounds
Restrict directory permissions
windowsManually secure the temporary directory permissions to prevent unauthorized writes.
icacls "C:\ProgramData\Atera\Temp" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges.
- Monitor file creation in Atera temporary directories for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check Atera Agent version in Control Panel > Programs and Features or via command: wmic product where name='Atera Agent' get versionCheck Version:
wmic product where name='Atera Agent' get versionVerify Fix Applied:
Verify version is 1.8.3.7 or later using the same method.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation in Atera temporary directories
- Failed permission changes to Atera directories
Network Indicators:
- None - this is a local file system vulnerability
SIEM Query:
EventID=4663 AND ObjectName LIKE '%Atera%Temp%' AND Accesses LIKE '%WriteData%'🔗 References
- https://github.com/mandiant/Vulnerability-Disclosures
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0008.md
- https://www.atera.com
- https://github.com/mandiant/Vulnerability-Disclosures
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0008.md
- https://www.atera.com
