CVE-2023-4003
📋 TL;DR
This vulnerability allows an unauthenticated attacker with physical access to a workstation running One Identity Password Manager 5.9.7.1 to escalate privileges to SYSTEM level. This affects organizations using this specific version of the password management software where workstations are accessible to potential attackers.
💻 Affected Systems
- One Identity Password Manager
📦 What is this software?
Password Manager by Oneidentity
Password Manager by Oneidentity
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of malware, credential theft, and persistent backdoor access to the entire system.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive credentials stored in the password manager and potential lateral movement within the network.
If Mitigated
Limited impact if physical access controls prevent unauthorized workstation access and proper endpoint security is in place.
🎯 Exploit Status
Exploitation requires physical access but no authentication. The unspecified method suggests details are not publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 5.9.7.1 (check vendor advisory for specific version)
Vendor Advisory: https://www.gov.il/en/Departments/faq/cve_advisories
Restart Required: Yes
Instructions:
1. Check current version of One Identity Password Manager. 2. Download and install the latest version from official vendor sources. 3. Restart the system to complete installation.
🔧 Temporary Workarounds
Physical Access Controls
allImplement strict physical security measures to prevent unauthorized access to workstations.
Endpoint Security Hardening
windowsEnable application whitelisting and restrict local privilege escalation capabilities.
🧯 If You Can't Patch
- Implement strict physical security controls and workstation locking policies
- Monitor for unusual privilege escalation events and restrict user permissions
🔍 How to Verify
Check if Vulnerable:
Check if One Identity Password Manager version is exactly 5.9.7.1Check Version:
Check application properties or vendor documentation for version informationVerify Fix Applied:
Verify installed version is newer than 5.9.7.1📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Unauthorized SYSTEM level process creation
Network Indicators:
- Local privilege escalation does not generate network traffic
SIEM Query:
EventID=4688 AND NewProcessName contains 'One Identity' AND SubjectUserName='SYSTEM'