dbcve.org
NetskopeApplication

CVE-2022-4149

HIGH · 7.0 CVSS v3.1 Published 2023-06-15
Fix available
A fix is available. Upgrade to 100 or later.
See remediation →
72/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Netskope client service on Windows runs as NT AUTHORITY\SYSTEM and writes log files to C:\Users\Public\netSkope, a directory writable by standard users. During service restart, a race condition occurs when the logplaceholder file is deleted and recreated, allowing a malicious local user to set ACL permissions on the file and make all files in the directory modifiable. Using Windows pseudo-symlinks, this can be leveraged for local privilege escalation.

MitigationUpgrade to Netskope client R96 or later which implements proper file permission handling and eliminates the race condition during service restarts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
NetskopeApplication
Affected:< 100

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify Netskope client installation
    Check for Netskope client by reviewing installed programs in Control Panel or running: Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object {$_.DisplayName -like '*Netskope*'}
    Affected if Netskope client is not installed or version is 100 or higher (not vulnerable)
  2. Confirm installed Netskope version
    Locate the Netskope client executable or check version via: (Get-Item 'C:\Program Files\Netskope\Netskope Endpoint Agent\NetskopeEndpointAgent.exe').VersionInfo.FileVersion or check registry for version info
    Affected if Installed version is less than 100 (vulnerable range)
  3. Check for vulnerable directory
    Verify the directory C:\Users\Public\netSkope exists using: Test-Path 'C:\Users\Public\netSkope'
    Affected if Directory exists and is writable by standard users (prerequisite for exploitation)
  4. Inspect directory ACL permissions
    Run: Get-Acl 'C:\Users\Public\netSkope' | Select-Object -ExpandProperty Access to check if standard users have write/modify permissions
    Affected if Standard users have write or modify access to the directory (vulnerable configuration)

Environment is affected if Netskope client version is below 100 AND the C:\Users\Public\netSkope directory exists with write permissions accessible to standard users.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 100 or later
Fixed in 100
Interim mitigation

Upgrade to Netskope client R96 or later which implements proper file permission handling and eliminates the race condition during service restarts.

Recommended fix High confidence

Netskope client R96 or later

  1. Upgrade Netskope client to version R96 or later to address the TOCTOU race condition vulnerability
  2. After upgrade, verify the service is running the updated version by checking the Netskope client version information
  3. Confirm that log files are now created with appropriate restrictive permissions that prevent unprivileged user modification

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Netskope Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing10.0 h
  • Review / QA4.0 h
32.0 hours of engineering $5,580
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,928.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-4149 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-4149 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data