CVE-2023-35799

What it actually does

The SES Evolution agent exposes insecure permissions that permit a local interactive user to instruct the agent to write arbitrary files to disk while running with local system privileges.

Why it matters to the business

Attackers who already have a foothold on an endpoint can obtain full administrative control, install persistent malware, steal credentials, or disrupt security controls, increasing the cost and scope of any breach.

How an attack unfolds

An attacker obtains an interactive session on a system running an affected version of Stormshield Endpoint Security Evolution, then issues commands through the agent that cause it to drop attacker-controlled files with SYSTEM rights, completing local privilege escalation.

How to fix it

Upgrade Stormshield Endpoint Security Evolution to a version that resolves the permission issue; until an update is available, restrict interactive logons on protected systems and monitor agent behavior for unexpected file creation.

How to confirm the fix worked

Confirm the installed agent version is outside the 2.0.0–2.3.2 range; review agent configuration and file-system ACLs on directories the agent can write to; test that non-privileged users cannot trigger file creation via the agent.

Typical attack path

1. Obtain local interactive access to a workstation or server protected by the vulnerable agent
2. Invoke the SES Evolution agent interface or API to request creation of arbitrary files
3. Place malicious executables, scripts, or configuration files that execute with SYSTEM privileges
4. Use the newly created files to establish persistence, disable defenses, or move laterally

How to detect it

Search endpoint logs and agent telemetry for file-creation events originating from the SES Evolution service or agent process where the creating user context is non-SYSTEM; correlate with unexpected binaries appearing in system directories shortly after user sessions begin.

• SES Evolution agent process spawning file writes to protected paths
• File creation events where parent process is SES agent and user is not SYSTEM
• Unexpected .exe or .dll files appearing in Windows system folders with recent timestamps matching user activity

What your security team should do

• Prioritize inventory of all endpoints running Stormshield Endpoint Security Evolution 2.0.0–2.3.2
• Apply the vendor-supplied update as soon as it becomes available
• Reduce the number of users granted interactive logons on protected hosts
• Enable enhanced logging of agent file-write operations for SIEM correlation