Privileged IPC Exposure in Telerik Fiddler Everywhere

Executive Summary

This vulnerability in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local attacker with low privileges to modify application launch parameters and trick a user into starting the application. This can lead to replacing the application UI or settings with malicious content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves local privilege escalation in Progress Telerik Fiddler Everywhere before version 8.2.0. Detection requires checking the installed version of Fiddler Everywhere on affected systems. Use system commands to verify the version installed.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disclose OAuth authentication tokens, run locally accessible programs without permission, or change application-generated configuration files without authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to disclosure of OAuth authentication tokens, which may expose sensitive user data. This could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such tokens or data are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Progress Telerik Fiddler Everywhere to version 8.2.0 or later to address the vulnerability. Restrict local user permissions where possible and monitor for unusual application behavior or unauthorized modifications.

Useful 0 Not Useful 0