CVE-2023-27470: N-able Take Control Race Condition Flaw

CVE-2023-27470 Overview

A Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability exists in the BASupSrvcUpdater.exe component of N-able Take Control Agent through version 7.0.41.1141. This vulnerability allows a local attacker to exploit a race condition via a pseudo-symlink at the %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates directory, leading to arbitrary file deletion on Windows systems.

Critical Impact

Local attackers with low privileges can exploit this race condition to delete arbitrary files on the system, potentially leading to denial of service, privilege escalation, or system compromise through deletion of critical security files.

Affected Products

• N-able Take Control Agent versions prior to 7.0.43
• N-able Take Control Agent through version 7.0.41.1141
• Microsoft Windows (as the operating platform)

Discovery Timeline

• 2023-09-11 - CVE-2023-27470 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-27470

Vulnerability Analysis

The vulnerability resides in the BASupSrvcUpdater.exe executable, which is part of the N-able Take Control Agent update mechanism. The flaw is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition), a category of vulnerabilities where a resource's state changes between the time it is checked and the time it is used.

In this specific case, the updater service performs operations on the %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates directory without properly handling the race window between checking a file's properties and performing operations on it. This timing gap can be exploited by an attacker who can manipulate the file system during this window.

Root Cause

The root cause of this vulnerability is improper synchronization in the file handling logic of the BASupSrvcUpdater.exe service. The service checks for the presence and properties of files in the PushUpdates directory, but does not adequately lock or verify the file state before performing deletion operations. This creates a race window where an attacker can substitute a legitimate file with a pseudo-symlink (junction point or symbolic link) pointing to a target file elsewhere on the system.

When the service proceeds with its file deletion operation, it follows the symlink and deletes the attacker-specified target file instead of the intended update file. Since the updater service typically runs with elevated privileges, this can result in deletion of files that would normally be protected from the low-privileged attacker.

Attack Vector

The attack requires local access to the system with low privileges. An attacker must be able to write to the %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates directory and win the race condition by creating a pseudo-symlink at the precise moment between the service's check and use operations.

The exploitation technique involves the following general approach:

1. The attacker monitors the PushUpdates directory for activity from the BASupSrvcUpdater service
2. When the service begins processing files, the attacker quickly replaces a legitimate file with a junction point or symbolic link
3. The junction point redirects to a target file the attacker wishes to delete (such as security software configurations, system files, or audit logs)
4. The service, believing it is operating on an update file, deletes the target file through the symlink

This attack can be weaponized using tools like the CreateSymlink utility or native Windows commands to rapidly create junction points during the race window. For detailed technical information, refer to the Mandiant Vulnerability Disclosure.

Detection Methods for CVE-2023-27470

Indicators of Compromise

• Unexpected junction points or symbolic links appearing in the %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates directory
• Anomalous file deletion events originating from BASupSrvcUpdater.exe targeting files outside the expected update paths
• Windows Security Event logs showing file deletions by the Take Control service account on sensitive system files

Detection Strategies

• Monitor file system activity for creation of junction points or symbolic links in the PushUpdates directory using endpoint detection tools
• Implement file integrity monitoring on critical system files and directories that could be targeted for deletion
• Configure Windows audit policies to log object access events on the %PROGRAMDATA%\GetSupportService_N-Central\ directory tree
• Use behavioral analysis to detect rapid file operations indicating race condition exploitation attempts

Monitoring Recommendations

• Deploy SentinelOne agents with file system monitoring capabilities to detect symlink manipulation in real-time
• Enable verbose logging for the N-able Take Control Agent service to capture anomalous update operations
• Establish baseline activity patterns for the BASupSrvcUpdater.exe process and alert on deviations
• Monitor for use of known symlink exploitation tools such as CreateSymlink.exe or similar utilities

How to Mitigate CVE-2023-27470

Immediate Actions Required

• Upgrade N-able Take Control Agent to version 7.0.43 or later immediately on all affected Windows systems
• Audit all systems running vulnerable versions to identify any signs of exploitation
• Restrict write access to the %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates directory to only the SYSTEM account and administrators
• Consider temporarily disabling the Take Control Agent on critical systems until patching is complete

Patch Information

N-able has addressed this vulnerability in Take Control Agent version 7.0.43 and later. Organizations should obtain the latest version through their N-able management console or contact N-able support for upgrade guidance. The patch implements proper file handling mechanisms that prevent the TOCTOU race condition from being exploited.

Workarounds

• Apply strict ACLs to the PushUpdates directory, removing write permissions for standard users while maintaining functionality
• Implement application whitelisting to prevent unauthorized symlink creation tools from executing
• Use Windows Defender Exploit Guard or similar endpoint protection features to block symlink abuse patterns
• Monitor and alert on any symbolic link creation in the affected directory path as an interim detection measure

# Configuration example: Restrict ACLs on the PushUpdates directory
icacls "%PROGRAMDATA%\GetSupportService_N-Central\PushUpdates" /inheritance:r
icacls "%PROGRAMDATA%\GetSupportService_N-Central\PushUpdates" /grant:r "SYSTEM:(OI)(CI)F"
icacls "%PROGRAMDATA%\GetSupportService_N-Central\PushUpdates" /grant:r "Administrators:(OI)(CI)F"