ownCloud Desktop Client 2.2.2 Privilege Escalation

`Horizontal Privilege Escalation/Code Injection in ownCloudas Windows Client  
  
Metadata  
===================================================  
Release Date: 17-08-2016  
Author: Florian Bogner @ Kapsch BusinessCom AG (https://www.kapsch.net/kbc)  
Affected versions: up to ownCloud's Desktop client version 2.2.2   
Tested on: Windows 7 64 bit  
CVE : pending  
URL: https://bogner.sh/2016/08/horizontal-privilege-escalation-in-ownclouds-windows-client/  
Video: https://www.youtube.com/watch?v=KytWLsrjyVk  
Vulnerability Status: Fixed in version 2.2.3 (oc-sa-2016-016)  
  
Description  
===================================================  
The ownCloud Windows Desktop client (up to version 2.2.2) is prone to an arbitrary code injection vulnerability leading to code execution in other user's Windows sessions.  
The issue is that QT extensions are loaded from C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins.  
As any authenticated user on Windows is allowed to create new folders within C:, the expected folder structure can be created.  
That means that any local attacker can create a malicious QT extensions that gets automatically loaded on the next launch of the ownCloud Desktop client in any local Windows session.  
  
PoC  
===================================================  
1.) Download the modified QT platform's library qwindow.dll: https://bogner.sh/wp-content/uploads/2016/08/qwindows.dll_.zip  
2.) Place it into C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins\platforms   
3.) Start the ownCloud Desktop Client: The "malicious" code is executed and a message box is opened  
  
Disclosure Timeline  
===================================================  
31.7.2016: The issues have been documented and reported  
4.8.2016: ownCloud verified the issue and started to work on a fix  
5.8.2016: Patch has been developed and I verified that the issue has been fixed  
8.8.2016: ownCloud Desktop Client 2.2.3 with the fix has been publicly released  
17.8.2016: ownCloud Security Advisory oC-SA-2016-016 has been published  
17.8.2016: Public disclosure  
  
Suggested Solution  
===================================================  
Install the latest available version from https://owncloud.org/install  
  
Florian Bogner  
  
eMail: [email protected]  
Web: http://www.bogner.sh  
LinkedIn: https://www.linkedin.com/profile/view?id=368904276  
Xing: https://www.xing.com/profile/Florian_Bogner9  
`