Executive Summary

This vulnerability is a race condition (TOCTOU) in Rufus versions 4.11 and below, occurring in the creation, validation, and execution of the Fido PowerShell script. Rufus runs with Administrator privileges but writes the script to the %TEMP% directory, which is writable by standard users, without locking the file. This allows a local attacker to replace the legitimate script with a malicious one between the write and execution steps, leading to arbitrary code execution with Administrator privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to execute arbitrary code with Administrator privileges on the affected system. This means the attacker could potentially take full control of the system, install malware, steal data, or disrupt system operations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Rufus to version 4.12_BETA or later, where the race condition issue has been fixed. Avoid running Rufus with elevated privileges if possible, and ensure that the %TEMP% directory is secured to prevent unauthorized modification of scripts during execution.

Useful 0 Not Useful 0