Executive Summary

CVE-2021-47852 is a privilege escalation vulnerability in Rockstar Games Launcher version 1.0.37.349. It occurs because the service executable, RockstarService.exe, has weak file permissions that allow any authenticated user with limited privileges to modify or replace it. An attacker can exploit this by substituting the legitimate executable with a malicious binary that, when run, creates a new administrator user on the system, thereby gaining elevated system-level access. [2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who already has a limited authenticated user account on the affected system to escalate their privileges to administrator level. By replacing the RockstarService.exe with a malicious executable, the attacker can create a new administrator user, gaining full control over the system. This elevated access can lead to unauthorized system modifications, data theft, installation of malware, or further attacks on the network. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the file permissions of the RockstarService.exe executable to see if the 'Authenticated Users' group has Modify (M) privileges, which should not be the case. On a Windows system, you can use the command 'icacls "<path_to_RockstarService.exe>"' to view the Access Control List (ACL) and verify if weak permissions are set that allow modification by authenticated users. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the permissions on the RockstarService.exe executable to prevent modification by non-administrative users. Specifically, remove Modify permissions for the 'Authenticated Users' group and ensure only trusted administrators have write access to the service executable. Additionally, monitor for any unauthorized changes to the executable and consider applying any patches or updates provided by Rockstar Games once available. [2, 3]

Useful 0 Not Useful 0