Headline
CVE-2021-40396: TALOS-2021-1408 || Cisco Talos Intelligence Group
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Summary
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
Tested Versions
Advantech DeviceOn/iService 1.1.7
Product URLs
https://www.advantech.com/support/details/utility?id=1-203BB0A
CVSSv3 Score
8.8 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
CWE-276 - Incorrect Default Permissions
Details
DeviceOn/iService is a comprehensive solution to manage multiple field devices in real-time.
By default, DeviceOn/iService Server is installed in the “c:\Program Files\Advantech\WISE-DeviceOn" directory, which allows the “Everyone” group to have “Full” privilege over various service binary files in the directory, including library and executabes files loaded by the “postgresql” service. The service executes these binaries with a “NT AUTHORITY\NETWORK SERVICE” privilege, leading to an escalation from any user to ‘NETWORK SERVICE’ when the file is replaced and service is restarted. As the service is also assigned SeImpersonatePrivilege it is then possible to take advantage of that permission to achieve reliable execution with NT SYSTEM privilege due to impersonation of the token.
c:\Program Files\Advantech\WISE-DeviceOn\database\PostgreSQL\pgsql\bin\psql.exe
Everyone:F
NT AUTHORITY\SYSTEM:F
c:\Program Files\Advantech\WISE-DeviceOn\database\PostgreSQL\pgsql\bin\pg_ctl.exe
Everyone:F
NT AUTHORITY\SYSTEM:F
c:\Program Files\Advantech\WISE-DeviceOn\database\PostgreSQL\pgsql\bin\postgres.exe
Everyone:F
NT AUTHORITY\SYSTEM:F
In addition, various DLL files can be used to perform similar exploitation of the system from the same installation folder:
libpq.dll
libeay32.dll
libiconv-2.dll
libintl-8.dll
ssleay32.dll
Timeline
2021-11-02 - Vendor Disclosure
2022-01-16 - Vendor Patched
2022-01-18 - Public Release
Discovered by Yuri Kramarz of Cisco Talos.