Full Report
A vulnerability in Nullsoft Scriptable Installer System (NSIS) software (CVE-2023-37378) used in Parasolid installers before V36 creates an “uninstall directory” with insufficient access control. This could allow an attacker to misuse the vulnerability, and potentially escalate privileges. Only systems where Parasolid is installed with a Parasolid installer is impacted. Siemens recommends to uninstall impacted Parasolid instances and reinstall with the latest installer available.
Analysis Summary
# Vulnerability: Insufficient Access Control in Parasolid Installer (NSIS) Leading to Potential Privilege Escalation
## CVE Details
- CVE ID: CVE-2023-37378
- CVSS Score: 7.8 (High)
- CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
## Affected Systems
- Products: Parasolid (installed via specific Parasolid installers utilizing NSIS).
- Versions: Parasolid V35.0 and V35.1 (All versions only if installed with the vulnerable Parasolid installer).
- Configurations: Systems where Parasolid has been installed using the affected installer version. NSIS vulnerability specifically targets versions *before v3.09*.
## Vulnerability Description
The vulnerability exists in the Nullsoft Scriptable Installer System (NSIS) software utilized by the Parasolid installer. The installer creates an "uninstall directory" with insufficient access control permissions. This flaw could be exploited by a local attacker to misuse the directory structure, potentially leading to privilege escalation on the affected system.
## Exploitation
- Status: PoC available (Inferred from CVSS vector details: E:P - Proof of Concept, meaning exploit code exists or is published)
- Complexity: Low (CVSS Vector: AC:L - Attack Complexity Low)
- Attack Vector: Local (CVSS Vector: AV:L - Attack Vector Local)
## Impact
- Confidentiality: High (CVSS Vector: C:H)
- Integrity: High (CVSS Vector: I:H)
- Availability: High (CVSS Vector: A:H)
## Remediation
### Patches
Siemens' recommended remediation involves replacing the vulnerable installation state:
1. **Uninstall** the impacted Parasolid instances using the provided uninstaller to remove the vulnerable directory.
2. **Reinstall** using the latest available installer downloaded from the Siemens Support portal.
### Workarounds
1. Ensure that only trusted persons have physical or logical access to the system.
2. Avoid the configuration of additional administrative or new user accounts on the impacted system.
3. Scan each computer where Parasolid has ever been installed with an up-to-date anti-virus program and follow its recommendations.
## Detection
- **Indicators of Compromise:** The critical indicator is the creation of the vulnerable "uninstall directory" implemented by the vulnerable NSIS installer, which possesses incorrect permissions.
- **Detection Methods and Tools:** Standard file system auditing or integrity monitoring tools might detect unauthorized modification attempts within directories created during the Parasolid installation process. Reference vendor advisories for product-specific remediation checks.
## References
- Vendor Advisory: SSA-116172
- Siemens Support Download Link (for latest installer): hXXps://support.sw.siemens.com/en-US/product/258316782/
- CVSS Information: hXXps://www.first.org/cvss/
- CWE Information: hXXps://cwe.mitre.org/