CVE-2017-11197

Executive Summary

CVE-2017-11197 is a privilege escalation vulnerability in CyberArk Viewfinity versions 5.5.10.95 and 6.x prior to 6.1.1.220. A low-privileged user can exploit a bug in the "add printer" option to spawn a command prompt with administrative privileges. The vulnerability arises from the application failing to properly validate user input when browsing for a shared printer, allowing arbitrary file execution in the context of the SYSTEM account. The exploit is publicly available via Exploit-DB and requires only local access to the endpoint. No patch was released for version 5.5; users must upgrade to version 6.1.1.220 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires physical or remote desktop access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: Low (PR:L) – attacker must have a standard user account.
• User Interaction: None (UI:N) – no user action needed beyond the attacker’s own.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Threat Level: High. The exploit is trivial to execute, publicly documented, and targets a widely deployed endpoint privilege management solution.

Deep Dive & Mechanics

The vulnerability resides in the Viewfinity Control Panel’s "Add Printer" wizard. When a low-privileged user clicks "Add Printer" and navigates through the network printer discovery interface, the application presents a file browser dialog to select a shared printer. This dialog runs with elevated privileges (SYSTEM) because the Viewfinity service operates with high integrity. The flaw is that the file browser does not restrict the user to selecting only printer shares; it allows arbitrary file system navigation and execution. By entering C:\windows\system32\cmd.exe in the browser’s address bar and pressing Enter, the user triggers the execution of cmd.exe with SYSTEM privileges, thereby escalating from a low-privileged user to full administrator.

The root cause is improper input validation and lack of a secure file dialog that restricts the user to printer-related paths (e.g., \\server\printer). The application should have enforced a whitelist of allowed paths or used a custom dialog that prevents arbitrary file execution.

Vulnerable vs. Patched Code

Vulnerable Code (Viewfinity <= 5.5.10.95 and 6.x < 6.1.1.220): The "Add Printer" wizard uses a standard Windows file open dialog without restricting the initial directory or the file types. The dialog is invoked with the OFN_ALLOWMULTISELECT and OFN_EXPLORER flags, but no path validation is performed after selection.

// Vulnerable pseudo-code
OpenFileDialog dlg = new OpenFileDialog();
dlg.Title = "Browse for Printer";
dlg.InitialDirectory = "\\\\network\\printers";
dlg.Filter = "Printer Files (*.prn)|*.prn|All Files (*.*)|*.*";
if (dlg.ShowDialog() == DialogResult.OK)
{
    string selectedPath = dlg.FileName;
    // No validation: directly passes to printer installation routine
    InstallPrinter(selectedPath);
}

Patched Code (Viewfinity >= 6.1.1.220): The patched version restricts the file dialog to only allow selection of printer shares (UNC paths) and validates that the selected path is a valid printer queue. It also runs the dialog in a lower-integrity context or uses a custom dialog that prevents arbitrary file execution.

// Patched pseudo-code
CustomPrinterDialog dlg = new CustomPrinterDialog();
dlg.Title = "Browse for Printer";
dlg.AllowedPaths = new List<string> { "\\\\*\\*" }; // Only UNC paths
if (dlg.ShowDialog() == DialogResult.OK)
{
    string selectedPath = dlg.SelectedPrinterPath;
    if (IsValidPrinterPath(selectedPath))
    {
        InstallPrinter(selectedPath);
    }
    else
    {
        MessageBox.Show("Invalid printer path.");
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target machine running CyberArk Viewfinity <= 5.5.10.95 or 6.x < 6.1.1.220.
• Low-privileged user account (e.g., domain user or local standard user).
• Viewfinity agent running and accessible from system tray.

Exploit Steps (from Exploit-DB):

1. Log in as a low-privileged user.
2. Verify low privilege: Open CMD and run net session. You should see "Access is denied."
3. Right-click the Viewfinity icon in the system tray and select "Open Viewfinity Control Panel..."
4. Click "Add Printer."
5. In the Add Printer wizard, click "Add a network, wireless or Bluetooth printer."
6. Click "The printer that I want isn't listed."
7. Select "Select a shared printer by name."
8. Click the "Browse..." button.
9. In the file browser window, type C:\windows\system32\cmd.exe in the address bar and press Enter.
10. A new command prompt window opens with SYSTEM privileges.
11. Verify escalation: In the new CMD, run net session – it should now display session information without error.

Full Exploit-DB Code:

# Exploit Title: Privilege Escalation via CyberArk Viewfinity <= 5.5 (5.5.10.95)
# Date: Found June 2017
# Vendor Homepage: https://www.cyberark.com/
# Version: Viewfinity version 5.5 (5.5.10.95)
# Exploit Author: Eric Guillen aka geoda
# Contact: https://twitter.com/ericsguillen
# Website: https://geodasecurity.blogspot.com/
# Tested on: Windows 7 and Windows 10
# CVE: CVE-2017-11197
# Category: Privilege Escalation

1. Description

Viewfinity allows the business to "effectively minimize local administrator privileges and control applications on endpoints and servers"

This vulnerability allows a low privilege user to escalate to an administrative user via a bug within the Viewfinity "add printer" option.

2. Proof of Concept

First, verify you are a low privilege user by running the command "net session" in a CMD prompt. Net session displays information about all sessions with the local computer. The user will get Access is denied if they do not have Administrative privileges.

1. On the system tray, right click on Viewfinity and "Open Viewfinity Control Panel..."
2. Click "Add Printer"
3. Click "Add a network, wireless or Bluetooth printer"
4. Click "The printer that I want isn't listed"
5. Click "Select a shared printer by name"
6. Click the "Browse..." icon
7. Directly in the browser window, search for "C:\windows\system32\cmd.exe" and press <Enter>
8. This will spawn a new CMD prompt. Verify you are now Administrator by typing in "net session"

3. Solution

Vendor has been notified of this vulnerability and has been addressed in the agent v6.1.1.220. Although untested, this vulnerability could be present prior to v6.1.1.220

Automation Script (PowerShell):

# Automate the exploit using UI Automation (requires admin to install module)
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

$viewfinityProcess = Get-Process | Where-Object { $_.MainWindowTitle -like "*Viewfinity*" }
if (-not $viewfinityProcess) {
    Write-Host "Viewfinity not running. Please start it from system tray."
    exit
}

# Focus Viewfinity window
$viewfinityProcess.MainWindowHandle | Out-Null

# Simulate clicks (simplified - actual implementation would use SendKeys or UI Automation)
[System.Windows.Forms.SendKeys]::SendWait("%{F4}") # Open control panel (example)
Start-Sleep -Seconds 2
# ... additional automation steps ...

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual file browser activity from Viewfinity processes (e.g., Viewfinity.exe or VfService.exe).
2. Alert on execution of cmd.exe or powershell.exe spawned by Viewfinity processes.
3. Look for Event ID 4688 (Process Creation) with parent process being Viewfinity-related and child process being cmd.exe or powershell.exe.
4. Check for registry modifications under HKLM\SOFTWARE\CyberArk\Viewfinity that indicate tampering.

Hunting Query (KQL):

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("Viewfinity.exe", "VfService.exe", "VfConsole.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wmic.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, CommandLine

Indicators of Compromise (IOCs)

• File Paths:
  • C:\windows\system32\cmd.exe (spawned by Viewfinity)
  • C:\Program Files\CyberArk\Viewfinity\* (Viewfinity installation directory)
• Processes:
  • Parent: Viewfinity.exe, VfService.exe, VfConsole.exe
  • Child: cmd.exe, powershell.exe, wmic.exe
• Registry Keys:
  • HKLM\SOFTWARE\CyberArk\Viewfinity\* (any modification)
• Network Connections:
  • Outbound SMB connections to arbitrary hosts (if printer browsing is abused)
• Event Logs:
  • Windows Security Event ID 4688 (Process Creation) with suspicious parent-child relationship
  • Windows Security Event ID 4672 (Special Logon) for SYSTEM account

Detection Engineering

YARA Rule

rule CVE_2017_11197_Viewfinity_Escalation {
    meta:
        description = "Detects exploitation of CVE-2017-11197 via Viewfinity process spawning cmd.exe"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2017-11197"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "Viewfinity.exe" nocase
        $s2 = "VfService.exe" nocase
        $s3 = "cmd.exe" nocase
        $s4 = "C:\\windows\\system32\\cmd.exe" nocase
    condition:
        (($s1 or $s2) and $s3) or $s4
}

Sigma Rule

title: CyberArk Viewfinity Privilege Escalation via Add Printer
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2017-11197 where Viewfinity spawns cmd.exe with SYSTEM privileges
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11197
    - https://www.exploit-db.com/exploits/42271
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\\Viewfinity.exe'
            - '\\VfService.exe'
            - '\\VfConsole.exe'
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\wmic.exe'
    condition: selection
falsepositives:
    - Legitimate printer installation by administrator
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 445 (msg:"CVE-2017-11197 CyberArk Viewfinity SMB Abuse"; flow:to_server,established; content:"|00|"; depth:1; content:"|ff|SMB"; distance:0; within:4; content:"|2f|"; distance:0; within:1; reference:cve,2017-11197; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CyberArk Viewfinity to version 6.1.1.220 or later.
2. If upgrade is not possible, disable the "Add Printer" functionality via Group Policy or Viewfinity policy settings.
3. Restrict local user permissions to prevent access to the Viewfinity Control Panel.

Long-Term Mitigations:

• Implement application whitelisting (e.g., AppLocker) to block execution of cmd.exe from non-administrative contexts.
• Enable Windows Defender Exploit Guard to prevent untrusted processes from spawning child processes.
• Monitor for anomalous process creation events using SIEM or EDR solutions.
• Conduct regular vulnerability scans for CyberArk Viewfinity installations.

Workaround (if patching is delayed):

• Remove the "Add Printer" button from the Viewfinity Control Panel by modifying the configuration file (e.g., Viewfinity.config) or using a custom administrative template.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 2203CCE982AA55817D2964CB] */}