CVE-2024-23773: Quest KACE Agent Privilege Escalation

CVE-2024-23773 Overview

CVE-2024-23773 is an arbitrary file deletion vulnerability in Quest KACE Agent for Windows, affecting versions 12.0.38 and 13.1.23.0. The flaw resides in the KSchedulerSvc.exe component, which runs with NT AUTHORITY\SYSTEM privileges. A local attacker with low privileges can abuse the service to delete arbitrary files on the host. The issue maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Quest documents its response in the Quest Security Advisory for CVEs.

Critical Impact
A local, authenticated attacker can delete any file on the system with SYSTEM privileges, enabling denial of service and privilege escalation via file-overwrite techniques.

Affected Products

Quest KACE Agent for Windows 12.0.38
Quest KACE Agent for Windows 13.1.23.0
Component: KSchedulerSvc.exe

Discovery Timeline

2024-04-30 - CVE-2024-23773 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23773

Vulnerability Analysis

The Quest KACE Agent includes KSchedulerSvc.exe, a Windows service that runs as NT AUTHORITY\SYSTEM to execute scheduled management tasks on managed endpoints. The service performs file operations without adequately validating the identity of the requesting user or the target file path. A local attacker who can interact with the service can direct it to delete files outside the directories the attacker would normally have access to.

Because the deletion occurs under the SYSTEM security context, the attacker bypasses discretionary access controls on protected files. The vulnerability is classified as a path traversal weakness, which in this case manifests as an arbitrary file delete primitive rather than file read or write.

Root Cause

The root cause is improper access control and insufficient path validation in KSchedulerSvc.exe. The service accepts file paths from a low-privileged caller and acts on them without enforcing that the caller has rights to the target file. There is no canonicalization check preventing traversal sequences or symbolic link redirection to protected locations.

Attack Vector

Exploitation requires local access and low-level user privileges on an endpoint running the vulnerable KACE Agent. The attacker interacts with the scheduler service to trigger a file deletion operation targeting a file of their choosing. Arbitrary file delete flaws in Windows services are commonly chained with techniques such as abuse of the Windows Installer rollback behavior to pivot from deletion to local privilege escalation to SYSTEM. User interaction is not required.

No verified public exploit code is available. Technical details are referenced in the Quest Security Advisory for CVEs.

Detection Methods for CVE-2024-23773

Indicators of Compromise

Unexpected deletion of files in protected directories such as C:\Windows\System32, C:\Program Files, or security product install paths on hosts running the KACE Agent.
File system activity originating from KSchedulerSvc.exe that targets paths outside the normal KACE working directories.
Service or application crashes that correlate with missing DLLs or configuration files on managed endpoints.

Detection Strategies

Monitor file deletion events (Windows Security Event ID 4660 with 4663) where the process is KSchedulerSvc.exe and the target is outside KACE directories.
Alert on symbolic link, junction, or mount point creation by non-administrative users under paths that KACE Agent processes read or write.
Correlate low-privileged process activity with subsequent SYSTEM-level file operations by the KACE scheduler service.

Monitoring Recommendations

Enable file system auditing on sensitive directories and the KACE Agent install path.
Baseline normal KSchedulerSvc.exe behavior and flag deviations in file paths touched by the service.
Forward endpoint telemetry to a centralized analytics platform to detect privilege escalation chains following suspicious deletions.

How to Mitigate CVE-2024-23773

Immediate Actions Required

Inventory all Windows endpoints running Quest KACE Agent versions 12.0.38 and 13.1.23.0.
Upgrade the KACE Agent to the fixed version identified in the Quest advisory as soon as feasible.
Restrict interactive and remote low-privileged access on hosts that cannot be immediately patched.
Review audit logs for prior anomalous file deletions attributable to KSchedulerSvc.exe.

Patch Information

Quest has published remediation guidance in the Quest Security Advisory for CVEs. Administrators should apply the vendor-supplied KACE SMA Agent update that addresses CVE-2024-23772, CVE-2024-23773, and CVE-2024-23774. Refer to the Quest KACE product page for current supported releases.

Workarounds

Limit which users can log on locally or via remote desktop to systems running the vulnerable agent until patched.
Apply strict file system auditing on the KACE Agent directories to detect tampering.
Enforce application control policies that prevent untrusted binaries from being executed by standard users on managed endpoints.

bash

# Query installed KACE Agent version on a Windows host
wmic product where "Name like 'Dell KACE%% Agent' or Name like 'Quest KACE%% Agent'" get Name,Version

# Verify the running scheduler service and its binary path
sc qc KSchedulerSvc