Horizon Alert
Summary of the vulnerability and why it matters
GnuPG for Windows has a critical vulnerability that allows low-privilege users to execute malicious code by manipulating configuration files. This issue arises from how permissions are managed on a common Windows directory, potentially enabling attackers to compromise user accounts.
- Local users can inject malicious code.
- Code execution in user's security context.
- Confirm relevance and understand potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker with basic user access on a Windows machine can exploit a weakness in how GnuPG handles file permissions. By creating a malicious configuration directory and files within a shared location, the attacker can trick GnuPG into running their code when the application starts. This could lead to the attacker gaining control of the victim's computer.
- Local user access is required.
- Attacker creates malicious GnuPG configuration.
- Leads to code execution as the victim user.
Live Threat
Current exploitation, exposure, and threat context
A low-privilege attacker on Windows could create a malicious GnuPG configuration directory under `C:\ProgramData`, leading to code execution within the victim user's security context when GnuPG components process the injected files.
- Code execution for victim user.
- Attacker creates malicious config files.
- Sensitive data access and modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in GnuPG for Windows, which allows for code execution via manipulated configuration files in a shared directory, likely falls under the responsibility of the Windows system administration or endpoint security teams. The first step is to identify all Windows systems with GnuPG installed, confirm if they are accessible to unprivileged users, and then determine the accountable owner for remediation or mitigation.
- Own: Windows System Administrators.
- Verify: GnuPG installation and user access.
- Action: Plan controlled remediation.
