This local iTunes privilege escalation vulnerability can cause big problems for Windows users.

Cyfirma Research recently discovered a serious security vulnerability affecting iTunes users on Windows systems.

This local privilege escalation vulnerability, classified as CVE-2024-44193, allows restricted attackers to escalate their privileges, potentially compromising entire systems.

Vulnerability present in iTunes for Windows version 12.13.2.3 and earlier pose a critical threat to the security of systems, so timely updates and patches are necessary.

Urgent iTunes update eliminates escalation risk

The underlying issue of CVE-2024-44193 is improper permission management, specifically related to AppleMobileDeviceService.exe.

Attackers can take advantage of the CVE-2024-44193 vulnerability by manipulating files inside C:\ProgramData\Apple\Quarantine catalog. With inadequate permissions settings, even low-privileged users can write arbitrary files to this directory, allowing attackers to create privilege escalation opportunities.

This vulnerability is not difficult to trigger, making it especially dangerous to exploit because attackers can use a variety of tools, such as NTFS connections and opportunistic locks, to create complex exploit chains that lead to the execution of arbitrary code with elevated privileges.

The CVE-2024-44193 exploit follows a structured sequence of steps that allows attackers to manipulate the AppleMobileDeviceService.exe file and gain elevated privileges. First, attackers create arbitrary files in the Lockdown directory, using tools like Oplock to stop processes at key moments. They can then use NTFS connections, which redirect file deletion to critical areas of the system.

These actions end up deleting important system files, giving the attacker administrative access. Ease of use coupled with widespread use of iTunes, especially in enterprise environments, increases the vulnerability risk profile. Organizations are strongly encouraged to update iTunes to version 12.13.3 or later to reduce risk.

The impact of this vulnerability is severe because it gives attackers administrative-level access to the target system. With SYSTEM level privileges, attackers can manipulate system files, install malwaregain access to confidential data and even disrupt services. This makes CVE-2024-44193 a critical risk for organizations, especially those with large numbers of unmanaged or legacy systems running vulnerable versions of iTunes.

There is currently no confirmed evidence that this vulnerability is being actively exploited in the wild, nor is there active discussion of this vulnerability on underground forums. However, the potential for its widespread use remains high due to the low complexity of the attack.

CVE-2024-44193 affects iTunes for Windows worldwide, affecting various industries that use Windows-based systems. Media and entertainment, education, government and corporate environments are particularly vulnerable due to the widespread use of iTunes. Additionally, organizations that handle sensitive data or operate in high-risk environments may face an increased risk of attacks.