Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-8290. PoCs published by geffner.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2020-8290, demonstrating a local privilege escalation vulnerability in Backblaze for Windows and macOS. The exploit leverages insecure directory permissions to replace a downloaded update executable, allowing an unprivileged user to gain SYSTEM/root privileges.
Description
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.
Exploits (1)
This repository contains a functional proof-of-concept exploit for CVE-2020-8290, demonstrating a local privilege escalation vulnerability in Backblaze for Windows and macOS. The exploit leverages insecure directory permissions to replace a downloaded update executable, allowing an unprivileged user to gain SYSTEM/root privileges.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H