SOUND4 Server Service 4.1.102 - Local Privilege Escalation

vendor:

SOUND4 Server

by:

LiquidWorm

7.2

CVSS

HIGH

Unquoted Search Path Issue

CWE

Product Name: SOUND4 Server

Affected Version From: 4.1.0102

Affected Version To: 4.1.0102

Patch Exists: NO

Related CWE:

CPE: a:sound4:sound4_server:4.1.102

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Home 64 bit (build 9200)

2022

SOUND4 Server Service 4.1.102 – Local Privilege Escalation

The application suffers from an unquoted search path issue impacting the service 'SOUND4 Server' for Windows. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Mitigation:

Ensure that all applications are installed in a directory with a path that does not contain spaces or relative paths. Ensure that all applications are installed in a directory with a path that does not contain spaces or relative paths. Ensure that all applications are installed in a directory with a path that does not contain spaces or relative paths.

Source

Exploit-DB raw data:

# Exploit Title: SOUND4 Server Service 4.1.102 - Local Privilege Escalation
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: 4.1.102

Summary: SOUND4 Windows Server Service.

Desc: The application suffers from an unquoted search path issue impacting
the service 'SOUND4 Server' for Windows. This could potentially allow an
authorized but non-privileged local user to execute arbitrary code with
elevated privileges on the system. A successful attempt would require the
local user to be able to insert their code in the system root path undetected
by the OS or other security applications where it could potentially be executed
during application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.

Tested on: Windows 10 Home 64 bit (build 9200)
           SOUND4 Server v4.1.102
           SOUND4 Remote Control v4.3.17


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5721
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php


26.09.2022

--


C:\>sc qc "SOUND4 Server"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SOUND4 Server
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\SOUND4\Server\SOUND4 Server.exe --service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SOUND4 Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>cacls "C:\Program Files\SOUND4\Server\SOUND4 Server.exe"
C:\Program Files\SOUND4\Server\SOUND4 Server.exe NT AUTHORITY\SYSTEM:(ID)F
                                                 BUILTIN\Administrators:(ID)F
                                                 BUILTIN\Users:(ID)R
                                                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


C:\Program Files\SOUND4\Server>"SOUND4 Server.exe" -V
4.1.102