CVE-2020-26894: 
Wildlife Issues in the New Millennium vulnerability analysis and mitigation

LiveCode v9.6.1 on Windows contains a privilege escalation vulnerability (CVE-2020-26894) that allows local, low-privileged users to gain elevated privileges. The vulnerability exists when the application uses LiveCode's "shell()" function, which attempts to search for "cmd.exe" in the folder of the current application. An attacker can exploit this by creating a malicious "cmd.exe" in the vulnerable LiveCode application's folder (NVD, CVE).

The vulnerability has a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from an uncontrolled search path element (CWE-427) where the application incorrectly searches for cmd.exe in the current application directory before checking system paths. This allows a local attacker to place a malicious cmd.exe file that will be executed when the shell() function is called (NVD).

If successfully exploited, this vulnerability allows an attacker with low privileges to execute arbitrary code with elevated permissions through a malicious cmd.exe file. This could lead to complete system compromise within the context of the vulnerable LiveCode application (NVD).

The vulnerability requires local access and low privileges to exploit. The attacker needs to be able to create files in the LiveCode application directory. No user interaction is required once the malicious file is in place, making it relatively straightforward to exploit when the conditions are met (NVD).

The vulnerability was addressed by ensuring the shellCommand defaults to COMSPEC on Windows systems. A fix was implemented in LiveCode that changes how the shell command processor is determined, using the COMSPEC environment variable instead of a hard-coded path (Github PR).