CVE-2021-30360: 
Check Point Harmony Endpoint vulnerability analysis and mitigation

CVE-2021-30360 is a local privilege escalation vulnerability affecting Check Point Enterprise Endpoint Security Client for Windows versions prior to E86.20. The vulnerability was discovered by Ronnie Salomonsen of Mandiant and was reported to Check Point on October 19, 2021. The issue was confirmed by Check Point on October 22, 2021, with a fix scheduled for January 5, 2022 (Mandiant Advisory).

The vulnerability exists in the Windows Installer framework implementation where an MSI file is cached in c:\windows\installer. The vulnerability is tracked as CWE-427 (Uncontrolled Search Path Element) and has received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability has been classified as high severity as successful exploitation provides an unprivileged local attacker with SYSTEM level privileges (Mandiant Advisory).

The exploitability is considered medium, as any authenticated local user can exploit the vulnerability. An unprivileged user can trigger a repair operation either through the Windows Installer API or by executing 'msiexec.exe /fa c:\windows\installer[XXXXX].msi'. The repair operation triggers file operations in the user's %TEMP% folder, with some operations performed in SYSTEM context through the Windows Installer service, including the execution of temporary files (Mandiant Advisory).

The vulnerability was addressed in version E86.20 of the Check Point Enterprise Endpoint Security Client for Windows. Users are advised to update to this version to mitigate the vulnerability (Mandiant Advisory).