CVE-2023-27470
📋 TL;DR
This vulnerability in N-able Take Control Agent allows attackers to delete arbitrary files through a time-of-check to time-of-use (TOCTOU) race condition. Attackers can exploit a pseudo-symlink in the PushUpdates directory to delete system files. Organizations using affected versions of Take Control Agent are at risk.
💻 Affected Systems
- N-able Take Control Agent
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical system files could be deleted, causing system instability, data loss, or complete system compromise if combined with other vulnerabilities.
Likely Case
Attackers delete important files to disrupt operations, cause denial of service, or remove security controls.
If Mitigated
With proper access controls and monitoring, impact is limited to potential service disruption in the Take Control Agent.
🎯 Exploit Status
Exploitation requires local access and ability to create files in the vulnerable directory. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.43 or later
Vendor Advisory: https://www.n-able.com/security-and-privacy/product-security-advisories
Restart Required: Yes
Instructions:
1. Download Take Control Agent version 7.0.43 or later from N-able portal. 2. Deploy to all affected systems. 3. Restart systems or services as required.
🔧 Temporary Workarounds
Restrict directory permissions
windowsLimit write access to the vulnerable PushUpdates directory to prevent file creation.
icacls "%PROGRAMDATA%\GetSupportService_N-Central\PushUpdates" /deny Everyone:(OI)(CI)(W)
🧯 If You Can't Patch
- Monitor file creation and deletion events in the vulnerable directory
- Implement strict access controls and audit privileged account usage
🔍 How to Verify
Check if Vulnerable:
Check Take Control Agent version and verify if it's 7.0.41.1141 or earlier.Check Version:
Check agent version in Take Control console or examine installed programs in Control Panel.Verify Fix Applied:
Confirm Take Control Agent version is 7.0.43 or later.📡 Detection & Monitoring
Log Indicators:
- File deletion events in %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates
- Unusual process activity from BASupSrvcUpdater.exe
Network Indicators:
- Unusual connections from Take Control Agent to unexpected destinations
SIEM Query:
EventID=4663 OR EventID=4656 AND ObjectName LIKE '%GetSupportService_N-Central%PushUpdates%'