Razer: Unauthenticated access to sensitive user information

The tester discovered that a THX server known primarily to THX employees was exposing several hundred records containing customer email addresses and in very few cases, a personal name. No other information was revealed. This issue was fixed shortly after the report. We appreciate @smalien's...

Razer: Payment PIN Verification Bypass

The tester originally reported a PIN bypass in the Razer Pay MY client and provided a video POC which was very helpful. This was fixed in client version 2.11. Razer Fintech appreciates the tester's assistance and patience helping us resolve this issue...

Razer: DLL Hijacking in Synapse 2 CrashSender1402.exe via version.dll

The tester determined that the Synapse 2 installed executable CrashSender1402.exe was subject to a DLL hijacking vulnerability. As this was no longer supported by the third party provider, Razer decided to remove this executable from future versions of Synapse 2...

Razer: 2FA doesn't work in "https://insider.razer.com"

Hello, I found 2FA bypass vulnerability in https://insider.razer.com and I found this feature not at all working after enabled 2FA. Please follow the below steps to reproduce the issue Steps to reproduce 1. Login to https://insider.razer.com with your credentials. 2. Next, go to Two-Step...

Razer: Insecure Logging - OWASP (2016-M2)

The tester discovered that the Razer Pay Android application was storing user data locally on the phone in the clear. An adversary would need access to the phone to obtain this information. The application was patched to avoid storing this information in version 2.10...

Razer: Misconfigured s3 Bucket exposure

Found a s3 bucket that belongs to razer and properly not configured. bucket name:- http://rzimageupload.s3.amazonaws.com/ Bucket Source:- https://api.razer.com Steps To reproduce:- 1. Go to https://api.razer.com and create a project . 2. In the project icon select an image from your computer. 3...

Razer: Race Condition in Oauth 2.0 flow can lead to malicious applications create multiple valid sessions

The tester discovered a flaw in the Razer ID authentication system that could allow multiple access tokens. This was a minor issue but could theoretically have led to extended access due to unexpired tokens. Razer thanks the tester for their diligence. Here is a write-up for similar bug:...

Razer: OTP token bypass in accessing user settings

The tester was able to determine that the OTP token used by Razer ID was not being properly verified against the specific user which would allow an adversary to replay their own OTP token against a different user. If the adversary also had been able to obtain the user's login and password through...

Razer US: Synapse 2.21 - DLL Hijacking vulnerability

Description of Vulnerability: When Razer Synapse starts on a Windows machine it tries to load a DLL RazerConfigNative.dll from the C:\ProgramData\Razer\Synapse\Devices directory. If a malicious attacker puts the malicious DLL in that directory, Razer Synapse will load it and run the code found in...

CVE-2019-13142

The RzSurroundVADStreamingService RzSurroundVADStreamingService.exe in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver. The DACL on this folder allows any user to overwrite contents of files in this folder,...

Privilege escalation

The RzSurroundVADStreamingService RzSurroundVADStreamingService.exe in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver. The DACL on this folder allows any user to overwrite contents of files in this folder,...

CVE-2019-13142

The RzSurroundVADStreamingService RzSurroundVADStreamingService.exe in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver. The DACL on this folder allows any user to overwrite contents of files in this folder,...

CVE-2019-13142

The RzSurroundVADStreamingService RzSurroundVADStreamingService.exe in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver. The DACL on this folder allows any user to overwrite contents of files in this folder,...

CVE-2019-13142

The CVE-2019-13142 issue affects Razer Surround 1.1.63.0, specifically the RzSurroundVADStreamingService.exe component. The service runs as SYSTEM and uses an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver; the DACL on this folder allows any user to overwrite file...

Razer US: Razer Synapse 3 Chromasdk.io Root CA with Private Key Re-use

The researcher found that a root certificate was preinstalled with the Chroma SDK with a exposed private key. He assisted us in testing a fix. This was integrated into the codebase in May and published at the end of June. We appreciate his assistance working with us on this issue. Razer Synapse 3...

Razer Synapse 3 Windows client local to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

A, vulnerability introduction Razer Synapse（Ray cloud software installed in the system a service Razer Synapse Service, the service to NT AUTHORITY\SYSTEM permissions to run 会加载C:\ProgramData\Razer\目录中的多个.NET assembly. C:\ProgramData\Razer\and its subdirectories/files in the permissions aspect is...

Razer Cortex Debugger Remote Command Execution

Razer "Cortex" has CEF debugger stub enabled by default allowing arbitrary remote command execution. I was alerted on twitter that the software distributed by Razer for their gaming equipment might be unsafe, I downloaded the ones I could see online to take a look. I have only looked at "Cortex",...

Razer Cortex Debugger Remote Command Execution Vulnerability

Razer Cortex has a CEF debugger stub enabled by default allowing arbitrary remote command execution. Razer "Cortex" has CEF debugger stub enabled by default allowing arbitrary remote command execution. I was alerted on twitter that the software distributed by Razer for their gaming equipment migh...

Razer US: DLL Hijacking Vulnerability in synapse-2

The Synapse 2 installer was subject to a DLL planting attack in the Downloads folder. This was fixed in May of 2019...

Razer Synapse rzpnk.sys Local Elevation of Privilege Vulnerability

Razer Synapse is a Razer device configuration software from Razer USA. A security vulnerability exists in the rzpnk.sys file in Razer Synapse version 2.20.15.1104. A local attacker can exploit the vulnerability to read or write to an arbitrary memory location to gain privileges...