{"id":23749,"date":"2022-03-22T11:03:52","date_gmt":"2022-03-22T10:03:52","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=23749"},"modified":"2022-03-22T11:05:28","modified_gmt":"2022-03-22T10:05:28","slug":"schwachstelle-cve-2022-22988-in-western-digital-edgerover-desktop-anwendung-ermglicht-admin-rechte-macos-windows","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2022\/03\/22\/schwachstelle-cve-2022-22988-in-western-digital-edgerover-desktop-anwendung-ermglicht-admin-rechte-macos-windows\/","title":{"rendered":"Vulnerability CVE-2022-22988 in Western Digital EdgeRover desktop application allows admin privileges (macOS, Windows)"},"content":{"rendered":"

\"Sicherheit[German<\/a>]I'm posting this briefly here on the blog because people in the readership may be using Western Digital's EdgeRover desktop application on macOS or Windows. The vulnerability CVE-2022-22988 in older versions of the app allows attackers to gain elevated privileges under the operating systems mentioned. The manufacturer has provided an update to close the vulnerability.<\/p>\n

<\/p>\n

\"\"The EdgeRover<\/a> desktop app is a centralised management solution for Western Digital and SanDisk products that unifies multiple digital storage devices under a single management interface. The manufacturer states:<\/p>\n

\n

EdgeRover\u2122 is a new, innovative personal content management app developed by Western Digital, a leading provider of data storage solutions. <\/p>\n

The desktop app includes free features. You can create a directory of all digital files stored on your Mac or Windows computer and supported external drives2 and conveniently search, browse and play content.<\/p>\n<\/blockquote>\n

The proprietary software solution promises to increase ease of use and convenience. It offers content search, category filtering, allows you to manage access permissions and more. Unfortunately, older versions of the app allow local privilege elevation on macOS and Windows. I came across the issue via the following tweet<\/a> from Bleeping Computer, among others. The colleagues have covered it here<\/a> in an article.<\/p>\n

\"Security:<\/a> <\/p>\n

Western Digital has published an arguably short security advisory<\/a> for vulnerability CVE-2022-22988<\/a> as of 18 March 2022. It states that EdgeRover was vulnerable to a directory traversal vulnerability. This allowed an attacker to perform a local privilege escalation and bypass the basic file system sandbox. If successfully exploited, these vulnerabilities could lead to disclosure of confidential information or denial of service. Updates to the app have been available from Western Digital since 10 March 2022 to close the vulnerability.<\/p>\n