Permission Issue in StableBit Scanner Service

Executive Summary

This vulnerability is a local privilege escalation flaw in StableBit Scanner 2.6.13.4088 caused by insecure deserialization in its .NET Remoting IPC endpoint. The ScannerService runs as LocalSystem and exposes a named pipe and IPC endpoint accessible to standard local users. An attacker can exploit this by sending a malicious BinaryFormatter gadget to gain arbitrary code execution in the LocalSystem context, allowing full local privilege escalation from a standard user account.

Useful 0 Not Useful 0

Detection Guidance

Check if the ScannerService.exe process is running and listening on the named pipe \\.\pipe\Scanner2_Comm using tools like Process Explorer or netstat. Look for unexpected connections to the IPC endpoint ipc://Scanner2_Comm/Comm1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with local access to a vulnerable system to escalate privileges from a standard user account to LocalSystem. This could lead to complete control over the affected system, enabling installation of malware, data theft, or further network compromise. The exploit does not require network access and works locally.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems, potentially violating compliance requirements for data protection and security. For GDPR, it may result in unauthorized data access or processing. For HIPAA, it could compromise protected health information. Organizations must address this flaw to maintain compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update StableBit Scanner to the latest version if available. Disable the BinaryFormatter-based .NET Remoting IPC endpoint in ScannerService.exe. Restrict access to the named pipe and IPC endpoint to authorized users only.

Useful 0 Not Useful 0