File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control

vendor:

File Replication Pro

by:

Andrea Intilangelo

9.8

CVSS

CRITICAL

Privilege Escalation/Password reset

264

CWE

Product Name: File Replication Pro

Affected Version From: 7.5.2000

Affected Version To: 7.5.2000

Patch Exists: NO

Related CWE: CVE-2023-26918

CPE: a:diasoft_corporation:file_replication_pro:7.5.0

Metasploit:

Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=159676, https://www.infosecmatter.com/nessus-plugin-library/?id=18405, https://www.infosecmatter.com/nessus-plugin-library/?id=26919, https://www.infosecmatter.com/nessus-plugin-library/?id=38734

Platforms Tested: Windows 10 Pro 22H2 x64

2023

File Replication Pro 7.5.0 – Privilege Escalation/Password reset due Incorrect Access Control

Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by replacing a file with another one that will be executed with 'LocalSystem' rights from Windows Services application. To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs with LocalSystem privileges as 'frp' (FRPReplicationServer) service, since the application's path has 'Everyone' full access permissions. Moreover, the 'properties.xml' file in the 'etc' folder inside program's path contains the hashed password for remote access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting a string in SHA-1 and encoding its digest via base64, will grant the login acess to the application with the new password.

Mitigation:

Ensure that the file/folder permissions are set correctly and restrict access to only authorized users.

Source

Exploit-DB raw data:

# Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
# Date: 2023-04-13
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com
# Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe
# Version: 7.5.0
# Tested on: Windows 10 Pro 22H2 x64
# CVE: CVE-2023-26918

Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by
replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.

C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro Everyone:(F)
                                    Everyone:(OI)(CI)(IO)(F)

C:\Users\Administrator>sc qc frp
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: frp
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : FRPReplicationServer
        DIPENDENZE                : Tcpip
                                  : Afd
        SERVICE_START_NAME : LocalSystem

To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs
with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full
access permissions.

Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote
access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting
a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface.