CVE-2023-54331

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-54331 is an unquoted service path vulnerability affecting Outline version 1.6.0. The issue resides in the OutlineService executable, where the service path is not properly quoted, enabling local privilege escalation. This flaw, classified under CWE-428, has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential upon successful exploitation.

Local attackers with low-privilege (PR:L) access on a vulnerable system can exploit the unquoted path by placing a malicious executable in a directory that precedes the legitimate OutlineService binary in the system's search path. When the OutlineService is started or restarted, the system executes the attacker's malicious code instead, granting LocalSystem-level privileges. This allows full control over the system, including arbitrary code execution with elevated permissions.

Advisories and references provide further details on the vulnerability. The Vulncheck advisory at https://www.vulncheck.com/advisories/outline-unquoted-service-path outlines the issue, while an exploit is publicly available at https://www.exploit-db.com/exploits/51128. The official Outline site at https://getoutline.org/ serves as a resource for the affected software. No specific patch details are detailed in the provided information.

A proof-of-concept exploit exists on Exploit-DB, demonstrating practical exploitability, though no evidence of widespread real-world exploitation is noted in the available data.