Wondershare Dr Fone 12.9.6 Weak Permissions / Privilege Escalation

Credit: Thurein Soe
Risk: Medium
Local: Yes
Remote: No

Executive Summary: Product Name: Wondershare Dr. Fone Vendor Home Page: https://drfone.wondershare.com Affected Version(s): Dr Fone version 12.9.6 Vulnerability Type: Execution with Unnecessary Privileges (CWE-250) CVE Reference: CVE-2023-27010. Credit: Thurein Soe Vendor Description: Wondershare Dr. Fone is an app designed to help with data recovery and management for all Android and iOS devices. Vulnerability description: Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on Windows have weak service permissions and are susceptible to local privilege escalation vulnerability. Weak service permissions run with system user permission, allowing a standard user/domain user to elevate to administrator privilege upon successfully modifying the service or replacing the affected executable. DriverInstall.exe gave modification permission to any authenticated users in the windows operating system, allowing standard users to modify the service and leading to Privilege Escalation. C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe" C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe Everyone:(ID)F NT AUTHORITY\SYSTEM:(ID)F BUILTIN\Administrators:(ID)F BUILTIN\Users:(ID)R APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst SERVICE_NAME: WsDrvInst TYPE : 10 WIN32_OWN_PROCESS START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : "C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe" LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : Wondershare Driver Install Service DEPENDENCIES : RPCSS SERVICE_START_NAME : LocalSystem References: https://cwe.mitre.org/data/definitions/250.html

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com


Back to Top