58 lines
No EOL
1.9 KiB
Text
58 lines
No EOL
1.9 KiB
Text
# Exploit Title: CCH Wolters Kluwer PFX Engagement <= v7.1 Local Privilege
|
|
Escalation
|
|
|
|
|
|
# Date: 11/26/14
|
|
# Exploit Author: singularitysec@gmail.com
|
|
# Vendor Homepage: www.cchgroup.com
|
|
|
|
# Version: PFX Engagement <= v7.1
|
|
# Tested on: Windows XP -> Windows 8, 2003, 2008, 2012
|
|
# CVE : 2014-9113
|
|
|
|
|
|
Product Affected:
|
|
CCH Wolters Kluwer PFX Engagement <= v7.1
|
|
This vulnerability has been reference checked this against multiple
|
|
installs. This configuration was identical across all systems and each
|
|
version encountered.
|
|
Executables/Services:
|
|
|
|
Pfx.Engagement.WcfServices
|
|
PFXEngDesktopService
|
|
PFXSYNPFTService
|
|
P2EWinService
|
|
Attack Detail:
|
|
The PFX services for engagement install with LOCAL SYSTEM service
|
|
credentials in the directory C:\PFX Engagement\
|
|
|
|
[image: Inline image 1]
|
|
|
|
|
|
The executables that are installed, by default, allow AUTHENTICATED USERS
|
|
to modify, replace or alter the file. This would allow an attacker to
|
|
inject their code or replace the executable and have it run in the context
|
|
of the system.
|
|
[image: Inline image 2]
|
|
This would allow complete compromise of a machine on which it was
|
|
installed, giving the process LOCAL SYSTEM access to the machine in
|
|
question. An attacker can replace the file or append code to the
|
|
executable, reboot the system or restart the service and it would then
|
|
compromise the machine. As LOCAL SYSTEM is the highest privilege level on
|
|
a machine, this allows total control and access to all parts of the system.
|
|
This affects both the server and workstation builds.
|
|
|
|
Remediation:
|
|
|
|
Remove the modify/write permissions on the executables to allow only
|
|
privileged users to alter the files.
|
|
Apply vendor patch when distributed.
|
|
|
|
|
|
Vulnerability Discovered: 11/26/2014
|
|
Vendor Notified: 11/26/2014
|
|
Vendor states this will be patched with next software update.
|
|
|
|
Website: www.information-paradox.net
|
|
This vulnerability was discovered by singularitysec@gmail.com. Please
|
|
credit the author in all references to this exploit. |