Executive brief
NetShareWatcher, a tool used by network administrators to monitor shared folder permissions and security policies, contains a vulnerability that could allow a local user to take full control of the system. By entering specially crafted text into the software's filter settings, an attacker can crash the application and execute malicious commands. This could lead to unauthorized access to sensitive data or a complete compromise of the workstation where the software is installed.
Technical details
A classic buffer overflow (CWE-120) exists in NetShareWatcher version 1.5.8.0 and potentially earlier versions. The vulnerability is located in the 'Restrictions' custom filter field within the application's settings. By supplying an overly long string to this field, a local attacker can overwrite the Structured Exception Handler (SEH) and Next SEH (NSEH) pointers. When the 'Find' function is subsequently invoked, the application triggers an exception, leading to the execution of the attacker-supplied shellcode. This exploit requires local access to the application interface but does not require elevated privileges or user interaction beyond the initial configuration of the malicious filter.
Affected products
- Nsasoft NetShareWatcher 1.5.8.0 and earlier
Timeline
- 2019-03-19: other: Exploit code originally authored
- 2019-03-20: disclosed: Exploit published on Exploit-DB
- 2026-06-04: advisory: CVE-2019-25733 published by NVD/VulnCheck