Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege

vendor:

Genie

by:

Tulpa

5.5

CVSS

MEDIUM

Unquoted Service Path Elevation of Privilege

426

CWE

Product Name: Genie

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE: a:netgear:genie:2.4.32

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 x86

2016

Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege

Netgear Genie installs a service called 'NETGEARGenieDaemon' with an unquoted service path running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.

Mitigation:

To mitigate this vulnerability, the vendor should update the installation process to ensure that the service path is quoted correctly. Users should also ensure that they are running the latest version of the software and apply any patches or updates provided by the vendor.

Source

Exploit-DB raw data:

# Exploit Title: Netgear Genie 2.4.32 Unquoted Service Path Elevation of Privilege
# Date: 30/09/2016
# Exploit Author: Tulpa
# Contact: tulpa@tulpa-security.com
# Author website: www.tulpa-security.com
# Vendor Homepage: www.netgear.com
# Software Link: https://www.netgear.com/home/discover/apps/genie.aspx?

cid=wmt_netgear_organic
# Version: Software Version 2.4.32
# Tested on: Windows 7 x86
# Shout-out to carbonated and ozzie_offsec

1. Description:

Netgear Genie installs a service called 'NETGEARGenieDaemon' with an unquoted service

path running with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

C:\Program Files>sc qc NETGEARGenieDaemon
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NETGEARGenieDaemon
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NETGEARGenieDaemon
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


3. Exploit:

A successful attempt would require the local user to be able to insert their
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges
of the application.