upKeeper Solutions upKeeper Instant Privilege Access Argument Injection Vulnerability Allowing Privileged Thread Hijacking

A command injection vulnerability has been identified in upKeeper Solutions upKeeper Instant Privilege Access, affecting versions through 1.5.0. This vulnerability arises from improper neutralization of argument delimiters, allowing commands to be injected into the application's internal communications. Exploitation of this issue enables hijacking of a privileged thread of execution, with injected commands being executed under the rights and context of the local upKeeper Instant Privilege service.

Impact

Exploitation of this vulnerability allows for unauthorized command execution within the upKeeper Instant Privilege client service, using the privileges of the local upKeeper Instant Privilege service.

Remediation

Users can update to upKeeper Instant Privilege Access version 1.6.0.4576 or later to address this vulnerability.