IBM Robotic Process Automation Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in IBM Robotic Process Automation versions 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18. The issue arises because all files in the installation inherit the file permissions of the parent directory. This allows a non-privileged user to replace any executable for the nssm.exe service. When the service or server is restarted, the substituted executable is executed with administrator privileges.

Impact

Exploitation of this vulnerability allows local users to escalate privileges, executing binaries with administrator rights.

Remediation

Users can upgrade to IBM Robotic Process Automation version 21.0.7.17 or 23.0.17. Instructions for upgrading can be found in the IBM Robotic Process Automation documentation. As a workaround, the registry can be modified to include quotes around the executable path for certain services, which prevents the privilege escalation.