SOYAL 701 Client 9.0.1 - Insecure Permissions

vendor:

701 Client

by:

LiquidWorm

7.2

CVSS

HIGH

Elevation of Privileges

264

CWE

Product Name: 701 Client

Affected Version From: 9.0.1 190410

Affected Version To: 9.0.1 190115

Patch Exists: NO

Related CWE: N/A

CPE: a:soyal_technology_co.ltd:701_client

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Microsoft Windows 10 Enterprise

2021

SOYAL 701 Client 9.0.1 – Insecure Permissions

The application suffers from an elevation of privileges vulnerability which can be used by a simple authenticated user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag (Full) for 'Authenticated Users' group.

Mitigation:

Ensure that the permissions on the executable file are properly set and that only authorized users have access to it.

Source

Exploit-DB raw data:

# Exploit Title: SOYAL 701 Client 9.0.1 - Insecure Permissions
# Date: 25.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com

Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: 9.0.1 190410
                  9.0.1 190115

Summary: 701 Client is the user interface software for the access control
system. It is used for adding and deleting tokens, setting door groups
for access, setting time zones for limiting access and monitoring ingress
and egress on a live system, among other things.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'F' flag (Full) for 'Authenticated Users'
group.

Tested on: Microsoft Windows 10 Enterprise


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5634
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php


25.01.2021

--


C:\Program Files (x86)\701Client>cacls client.exe
C:\Program Files (x86)\701Client\client.exe NT AUTHORITY\Authenticated Users:F
                                            NT AUTHORITY\Authenticated Users:(ID)F
                                            NT AUTHORITY\SYSTEM:(ID)F
                                            BUILTIN\Administrators:(ID)F
                                            BUILTIN\Users:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


C:\Program Files (x86)\701Client>