CVE-2023-37907
📋 TL;DR
This vulnerability allows local privilege escalation (LPE) in Cryptomator's MSI installer repair function. Low-privileged users can exploit administrative command prompts spawned during repair to gain elevated system privileges. Only affects Windows systems with Cryptomator installed.
💻 Affected Systems
- Cryptomator
📦 What is this software?
Cryptomator by Cryptomator
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full administrative control over the Windows system, enabling installation of malware, data theft, or persistence mechanisms.
Likely Case
Local user with limited privileges escalates to administrator to bypass security controls or access restricted resources.
If Mitigated
Attack fails due to proper user privilege separation and application of the patch.
🎯 Exploit Status
Exploitation requires local access and knowledge of the vulnerability. The advisory describes it as a 'simple LPE' via breakout from administrative CMDs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.2
Vendor Advisory: https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq
Restart Required: No
Instructions:
1. Download Cryptomator 1.9.2 or later from official sources. 2. Uninstall previous version. 3. Install new version. 4. Verify installation is version 1.9.2 or higher.
🔧 Temporary Workarounds
Remove vulnerable Cryptomator installation
windowsUninstall Cryptomator completely to eliminate the vulnerability
Control Panel > Programs > Uninstall Cryptomator
Restrict local user privileges
windowsImplement least privilege principles to limit local user capabilities
🧯 If You Can't Patch
- Remove Cryptomator from systems where it's not essential
- Implement strict user privilege separation and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Cryptomator version: Open Cryptomator > Help > About. If version is below 1.9.2, system is vulnerable.Check Version:
wmic product where name='Cryptomator' get versionVerify Fix Applied:
Confirm Cryptomator version is 1.9.2 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing unexpected administrative command prompt execution
- Process creation events for cmd.exe with elevated privileges from Cryptomator processes
Network Indicators:
- No network indicators - local privilege escalation only
SIEM Query:
Process Creation where (Image contains 'cmd.exe' AND ParentImage contains 'msiexec.exe' AND IntegrityLevel='High') OR (ProcessName='cmd.exe' AND ParentProcessName contains 'Cryptomator')🔗 References
- https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208c
- https://github.com/cryptomator/cryptomator/releases/tag/1.9.2
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq
- https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208c
- https://github.com/cryptomator/cryptomator/releases/tag/1.9.2
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq
