[FD] HP SimplePass Local Privilege Escalation

[Rehan Ahmed <knight_rehan@xxxxxxxxxxx>]

# Vulnerability Title: HP SimplePass Local Privilege Escalation
# Advisory Release Date: 05/18/2017
# Credit: Discovered By Rehan Ahmed
# Contact: knight_rehan@xxxxxxxxxxx
# Severity Level: Medium
# Type: Local
# Tested Platform: Windows 8 & 10 x64
# Vendor: HP Inc.
# Vendor Site: http://www.hp.com
# Download Link: http://ftp.hp.com/pub/softpaq/sp64001-64500/sp64339.exe
# Vulnerable Version: HP SimplePass 8.00.49, 8.00.57, 8.01.46 
# Vendor Contacted: 04/03/2017
# Vendor Response: 5/18/2017

########################################################################################
Summary:
########################################################################################
HP SimplePass allows you to safely store logon information for your favorite 
websites, and use a single method of authentication for your password-protected 
website accounts. Choose a fingerprint, password or PIN to authenticate your 
identity. Your computer must have at least one password-protected Windows User 
Account to use HP SimplePass.

https://support.hp.com/us-en/document/c03653209

#########################################################################################
Issue Details:
#########################################################################################

HP SimplePass is prone to a local privilege-escalation vulnerability due to 
insecure file system permissions that have been granted during installation. 
Local adversary can exploit this issue to gain elevated privileges on affected 
system.
HP SimplePass installs by default to "C:\Program 
Files\Hewlett-Packard\SimplePass" with very weak folder permissions granting 
any user full permission to the contents of the directory and it's subfolders. 
This allows ample opportunity for code execution against any other user running 
the application. HP SimplePass has few binaries which are typically configured 
as a service or startup program which makes this particularly easy to take 
leverage.
 
##########################################################################################
 
Proof of Concept
##########################################################################################
a) C:\>icacls "C:\Program Files\Hewlett-Packard\SimplePass"

C:\Program Files\Hewlett-Packard\SimplePass Everyone:(F)
                                            Everyone:(OI)(CI)(IO)(F)
                                            BUILTIN\Administrators:(I)(F)
                                            
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                            NT AUTHORITY\SYSTEM:(I)(F)
                                            NT 
AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                            NT AUTHORITY\Authenticated 
Users:(I)(M)
                                            NT AUTHORITY\Authenticated 
Users:(I)(OI)(CI)(IO)(M)
                                            BUILTIN\Users:(I)(RX)
                                            BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
  

b) C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" 
| findstr /i "HP SimplePass"

HP SimplePass Cachedrv Service   Cachedrv server   "C:\Program 
Files\Hewlett-Packard\SimplePass\cachesrvr.exe"       Auto
HP SimplePass Service            omniserv           C:\Program 
Files\Hewlett-Packard\SimplePass\OmniServ.exe         Auto

A user can place a malicious DLL/EXE (e.g OmniServ.exe) file with one of the 
expected names into that directory and wait until the service is restarted. The 
service can not be restarted by normal users but an attacker could just reboot 
the system or wait for the next reboot to happen.

###############################################################################################
3) Mitigation:
###############################################################################################
 

Change the permission for dirctory to group other than Administrator on 
Read/Execute.
Fix: 
https://support.hp.com/us-en/drivers/selfservice/hp-envy-m7-n100-notebook-pc/8499292/model/8788306



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/