// For flags

CVE-2022-3421

Privilege escalation in Google Drive for Desktop on MacOS

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set its setuid bit. Since the attacker owns the directory, the attacker can replace the binary with a symlink, causing the installer to set the setuid bit on the symlink. When the symlink is executed, it will run with root permissions. We recommend upgrading past version 64.0

Un atacante puede pre crear el directorio "/Applications/Google\ Drive.app/Contents/MacOS" que es esperado que sea propiedad de root para que sea propiedad de un usuario no root. Cuando el instalador de Drive for Desktop sea ejecutado por primera vez, colocará un binario en ese directorio con permisos de ejecución y establecerá su bit setuid. Dado que el atacante es el propietario del directorio, puede sustituir el binario por un enlace simbólico, causando que el instalador establezca el bit setuid en el enlace simbólico. Cuando el enlace simbólico sea ejecutado, lo hará con permisos de root. Recomendamos actualizar la versión anterior 64.0

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-07 CVE Reserved
  • 2022-10-17 CVE Published
  • 2024-05-09 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
  • CWE-269: Improper Privilege Management
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://support.google.com/a/answer/7577057?hl=en 2022-10-19
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Google
Search vendor "Google"
 Drive
Search vendor "Google" for product "Drive"
 < 64.0
Search vendor "Google" for product "Drive" and version " < 64.0"
-
Affected
in Apple
Search vendor "Apple"
 Macos
Search vendor "Apple" for product "Macos"
--
Safe