A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.
Solution:
While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
| Link | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03 | us government resource |
| https://openautomationsoftware.com/downloads/ | product |