Security readout for executives and security teams
Plain-English summary
CVE-2017-13779 is a local privilege escalation issue in GSTN Offline Utility before version 1.2. The tool runs a script from a Windows folder with insecure permissions, so a local user could replace that script and have their code run with higher privileges.
Executive priority
Treat this as a targeted endpoint hardening issue, not an internet-wide emergency. Prioritize finance, tax, and shared Windows systems where GSTN Offline Utility may be installed and local users have access.
Technical view
GSTN_offline_tool executes winstart-server.vbs from C:\GST Offline Tool. Sources state that directory permissions are insecure in versions before 1.2, allowing local users to replace the script with arbitrary VBScript and later trigger elevated execution.
Likely exposure
Exposure is likely limited to Windows systems that installed India GSTN Offline Utility before 1.2 and retain writable permissions on C:\GST Offline Tool. The source bundle does not identify CPEs, supported platforms, or deployment prevalence.
Exploitation context
The CVE is not listed as KEV in the supplied data, and no supplied source states active exploitation. Exploitation requires local access or a local foothold able to modify the tool directory.
Researcher notes
The record has sparse metadata: no CVSS, CWE, CPE, or vendor advisory is present in the supplied bundle. Analysis relies mainly on the CVE description and the referenced public writeup, so verify product behavior in a controlled environment before broad conclusions.
Mitigation direction
- Inventory GSTN Offline Utility installations and versions on Windows endpoints.
- Upgrade affected installations to version 1.2 or later where vendor guidance confirms remediation.
- Restrict write permissions on C:\GST Offline Tool to trusted administrators.
- Remove unused GSTN Offline Utility installations from managed systems.
- Review vendor guidance before relying on permission changes alone.
Validation and detection
- Check whether GSTN Offline Utility is installed and below version 1.2.
- Review ACLs on C:\GST Offline Tool for non-administrator write access.
- Verify winstart-server.vbs ownership, hash, and modification history.
- Search endpoint telemetry for unexpected script changes in the tool directory.
- Confirm remediation by retesting folder write permissions after upgrade or hardening.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-13779 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://tink2hack.blogspot.in/2017/09/writeup-of-cve-2017-13779-remote.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.