Link Following in CCleaner Prior to 7.10.1464

Executive Summary

This is a link following vulnerability in the CCleaner Uninstaller component. A local attacker with low privileges can create a symlink or junction during uninstallation. When CCleaner deletes the application's data folder with elevated permissions, it follows the symlink, allowing the attacker to escalate privileges to SYSTEM level.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for symlinks or junctions in the CCleaner data folder during uninstallation. Monitor the uninstallation process for unexpected file operations or privilege escalation attempts. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of CCleaner on Windows, a local attacker could exploit this to gain full control of your system. This could allow them to install malware, steal data, or perform other malicious actions with SYSTEM privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local privilege escalation to SYSTEM via symlink attacks during uninstallation. While not directly tied to data handling, such privilege escalation could potentially lead to unauthorized access to sensitive data, which may impact compliance with GDPR (data protection) or HIPAA (health data privacy) if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update CCleaner to version 7.10.1464 or later to address the vulnerability. Avoid running CCleaner uninstallation as a low-privileged user until patched. Monitor system logs for unusual activity during uninstallation.

Useful 0 Not Useful 0