Wondershare Dr.Fone 12.9.6 Weak Permissions / Privilege Escalation Vulnerability

2023-03-1200:00:00

Thurein Soe

0day.today

213

wondershare dr. fone

data recovery

android

ios

vulnerability

weak permissions

privilege escalation

windows

service

vulnerable version

cve-2023-27010

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.1%

JSON

Executive Summary:

Product Name: Wondershare Dr. Fone
Vendor Home Page:  https://drfone.wondershare.com
Affected Version(s): Dr Fone version 12.9.6
Vulnerability Type: Execution with Unnecessary Privileges (CWE-250)
CVE Reference: CVE-2023-27010.
Credit: Thurein Soe


Vendor Description:

Wondershare Dr. Fone is an app designed to help with data recovery and
management for all Android and iOS devices.

Vulnerability description:

Wondershare Dr Fone version 12.9.6 running services named "WsDrvInst" on
Windows have weak service permissions and are susceptible to local
privilege escalation vulnerability. Weak service permissions run with
system user permission, allowing a standard user/domain user to elevate to
administrator privilege upon successfully modifying the service or
replacing the affected executable. DriverInstall.exe gave modification
permission to any authenticated users in the windows operating system,
allowing standard users to modify the service and leading to Privilege
Escalation.

C:\Users\NyaMeeEain\Desktop>cacls "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
C:\Program Files (x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe
 Everyone:(ID)F

NT AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R
C:\Users\NyaMeeEain\Desktop>sc qc WsDrvInst
SERVICE_NAME: WsDrvInst
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files
(x86)\Wondershare\drfone\Addins\Repair\DriverInstall.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem


References:
https://cwe.mitre.org/data/definitions/250.html