CVE-2024-31498

techprofits

A vulnerability (CVE-2024-31498) has been identified in the YubiKey Manager GUI (ykman-gui) software versions prior to 1.2.6 on Windows systems. The flaw could allow for unexpected privilege escalation. The issue arises because Windows requires administrative permissions to interact with FIDO authenticators like YubiKeys. If a user runs the YubiKey Manager GUI as an administrator, any browser windows opened by the GUI may also be opened with administrator privileges. This could potentially be exploited by a local attacker to perform actions with elevated administrator access, depending on the specific browser being used. Some browsers like Microsoft Edge have additional mitigations to prevent this. The advisory states that the vulnerability only affects Windows installations of the YubiKey Manager GUI. Versions on other operating systems are not impacted. Additionally, the YubiHSM, YubiKey, and other Yubico security devices are not affected by this flaw. The recommended mitigation is to upgrade to YubiKey Manager GUI version 1.2.6 or newer, which addresses this privilege escalation vulnerability. Users are advised not to run the YubiKey Manager GUI with administrator privileges unless absolutely necessary on Windows systems. https://t.co/WdrDs31AUI