Ivanti Workspace Control Application PowerGrid RWS Whitelist Bypass
Posted by deepcore on October 2, 2018 – 1:05 pm
It was found that the PowerGrid application will execute rundll32.exe from a relative path when it is started with the /RWS command line option. An attacker can abuse this issue to bypass Application Whitelisting in order to run arbitrary code on the target machine. This issue was successfully verified on Ivanti Workspace Control version 10.2.700.1.
Post a reply
You must be logged in to post a comment.