Wondershare MirrorGo Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in Wondershare MirrorGo version 2.0.11.346. This issue arises from incorrect file permissions on executable files, allowing unprivileged local users to replace 'ElevationService.exe' with a malicious file. The replacement file can then be executed with LocalSystem privileges, potentially leading to arbitrary code execution.

Impact

Exploitation of this vulnerability allows for local privilege escalation, with unauthorized users gaining LocalSystem privileges.

Reproduction

The vulnerability can be reproduced by taking advantage of the insecure file permissions on executable files within the Wondershare MirrorGo installation directory. Unprivileged users can replace 'ElevationService.exe' with a malicious version, which will be executed by the 'ElevationService' Windows service running under LocalSystem privileges.