CVE-2024-27674
📋 TL;DR
CVE-2024-27674 is a privilege escalation vulnerability in Macro Expert software where unprivileged users can replace the MacroService.exe binary due to overly permissive folder permissions. This allows local attackers to escalate privileges to SYSTEM level. All users running Macro Expert through version 4.9.4 on Windows systems are affected.
💻 Affected Systems
- Macro Expert
📦 What is this software?
Macro Expert by Macro Expert
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full SYSTEM privileges, enabling complete system compromise, persistence, credential theft, and lateral movement.
Likely Case
Malicious insider or compromised user account escalates to SYSTEM to install malware, backdoors, or steal sensitive data.
If Mitigated
Attack fails due to proper access controls, user privilege restrictions, or security monitoring detecting unauthorized file modifications.
🎯 Exploit Status
Exploitation requires local user access but is straightforward - simply replacing the binary with malicious code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.macro-expert.com/
Restart Required: No
Instructions:
1. Check vendor website for updates
2. Install latest version if available
3. Verify folder permissions are corrected
🔧 Temporary Workarounds
Restrict Macro Expert Folder Permissions
windowsRemove BUILTIN\Users write permissions from the Macro Expert installation folder
icacls "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" /remove "BUILTIN\Users" /T
Disable Macro Expert Service
windowsStop and disable the MacroService to prevent execution of replaced binaries
sc stop MacroService
sc config MacroService start= disabled
🧯 If You Can't Patch
- Uninstall Macro Expert if not required
- Implement strict access controls and monitoring on the installation folder
🔍 How to Verify
Check if Vulnerable:
Check folder permissions: icacls "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" | findstr "BUILTIN\\Users.*M"Check Version:
Check Macro Expert version in Help > About or program files propertiesVerify Fix Applied:
Verify BUILTIN\Users no longer has Modify (M) permissions on the folder📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system access) showing unauthorized writes to Macro Expert folder
- Sysmon Event ID 11 (FileCreate) targeting MacroService.exe
Network Indicators:
- None - local exploitation only
SIEM Query:
source="Windows Security" EventID=4663 ObjectName="*Macro Expert*" AccessMask="0x2" OR source="Sysmon" EventID=11 TargetImage="*MacroService.exe*"