Local Privilege Escalation in Hyland Desktop Host for Windows

Executive Summary

This vulnerability is a local privilege escalation issue in Hyland Desktop Host for Windows before version 25.1.1. A privileged service runs from a folder with weak permissions, allowing a local user to replace a DLL file. The service loads a non-existent DLL named cryptbase.dll from this folder, which an attacker can replace with a malicious one to gain elevated privileges.

Useful 0 Not Useful 0

Detection Guidance

Check the Hyland Desktop Host installation directory for weak permissions on C:\ProgramData\Hyland\DesktopHost\bin. Verify if cryptbase.dll exists or if non-privileged users can write files there. Use icacls to inspect permissions: icacls "C:\ProgramData\Hyland\DesktopHost\bin"

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could exploit this to gain higher privileges, such as LOCAL SERVICE, potentially allowing them to execute arbitrary code, steal data, or disrupt system operations. This could lead to unauthorized access to sensitive information or system control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to inadequate security controls protecting personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Update Hyland Desktop Host to version 25.1.1 or later. Remove write permissions for non-privileged users from the C:\ProgramData\Hyland\DesktopHost\bin directory. Delete any suspicious cryptbase.dll files in that folder.

Useful 0 Not Useful 0