May Posted May 9, 2023 Share Posted May 9, 2023 Hello there, our team is thinking of using AutoIT to automate some tasks and typically we conduct a search of known vulnerabilities before we integrate new tools. I wasn't able to find much on AutoIT, except CVE-2017-6714, which was assigned to Cisco for remediation. Does AutoIT release a list of identified and remediated vulnerabilities? Also, does anyone have suggestions on how to reduce and control the security risks posed with using AutoIT in user workstations and servers? Would appreciate your feedback. Link to comment Share on other sites More sharing options...
spudw2k Posted May 10, 2023 Share Posted May 10, 2023 The AutoIT service referred to in the CVE is a different thing. As far as identified vuls and remediations go, I'm not sure you'll find anything beyond the change log. What I can say, from my experience, is that there doesn't appear to be anything inherently insecure about AutoIt or the AutoIt interpreter in itself, as it does not load any persistent running elevated software (e.g. services, etc.). It is my position that it should be treated as any other scripting/interpreted language (e.g. PowerShell, VBS, Python, etc.) and it is up to the usage, operation, and scripter whether or not security concerns are introduced/addressed. Spoiler Things I've Made: Always On Top Tool ◊ AU History ◊ Deck of Cards ◊ HideIt ◊ ICU ◊ Icon Freezer ◊ Ipod Ejector ◊ Junos Configuration Explorer ◊ Link Downloader ◊ MD5 Folder Enumerator ◊ PassGen ◊ Ping Tool ◊ Quick NIC ◊ Read OCR ◊ RemoteIT ◊ SchTasksGui ◊ SpyCam ◊ System Scan Report Tool ◊ System UpTime ◊ Transparency Machine ◊ VMWare ESX BuilderMisc Code Snippets: ADODB Example ◊ CheckHover ◊ Detect SafeMode ◊ DynEnumArray ◊ GetNetStatData ◊ HashArray ◊ IsBetweenDates ◊ Local Admins ◊ Make Choice ◊ Recursive File List ◊ Remove Sizebox Style ◊ Retrieve PNPDeviceID ◊ Retreive SysListView32 Contents ◊ Set IE Homepage ◊ Tickle Expired Password ◊ Transpose ArrayProjects: Drive Space Usage GUI ◊ LEDkIT ◊ Plasma_kIt ◊ Scan Engine Builder ◊ SpeeDBurner ◊ SubnetCalcCool Stuff: AutoItObject UDF ◊ Extract Icon From Proc ◊ GuiCtrlFontRotate ◊ Hex Edit Funcs ◊ Run binary ◊ Service_UDF Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now