CVE-2022-4991

Executive Summary

CVE-2022-4991 is a privilege escalation vulnerability in Tychon software on Windows. The issue stems from an OpenSSL component bundled with Tychon that uses a configurable OPENSSLDIR variable. An unprivileged user can place a malicious openssl.cnf file in a subdirectory controlled by them, which is then loaded by a privileged Tychon service. This allows arbitrary code execution with SYSTEM privileges. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It involves a custom OpenSSL component distributed with Tychon.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – requires local access to the Windows system.
• Attack Complexity (AC): Low (L) – no special conditions beyond file placement.
• Privileges Required (PR): Low (L) – attacker needs unprivileged user access.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – full system compromise.
• Integrity (I): High (H) – arbitrary code execution.
• Availability (A): High (H) – potential denial of service or system takeover.

CVSS Score: 7.8 (High) – Local privilege escalation with high impact.

Deep Dive & Mechanics

The vulnerability exists in Tychon’s inclusion of an OpenSSL library that reads configuration from a directory specified by the OPENSSLDIR environment variable or compile-time path. On Windows, this path may be set to a user-writable location (e.g., C:\Users\<username>\AppData\Local\Temp). The Tychon privileged service (running as SYSTEM) loads this OpenSSL component, which then reads openssl.cnf from the OPENSSLDIR. An attacker with low privileges can craft a malicious openssl.cnf file containing directives that execute arbitrary commands (e.g., using the openssl_conf section to load a dynamic engine). When the service starts or performs cryptographic operations, the malicious config is parsed, leading to code execution as SYSTEM.

Root Cause: The OpenSSL component does not restrict the OPENSSLDIR to a secure, system-only path, allowing user-controlled directories to influence the configuration.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code path involves the OpenSSL initialization routine that reads openssl.cnf from OPENSSLDIR. A hypothetical fix would hardcode the path to a system-protected directory (e.g., C:\ProgramData\Tychon\openssl) and validate the configuration file’s integrity.

Vulnerable (pseudocode):

// OpenSSL initialization in Tychon service
char *openssldir = getenv("OPENSSLDIR");
if (openssldir == NULL) {
    openssldir = DEFAULT_OPENSSLDIR; // e.g., "C:\Users\Public\openssl"
}
char config_path[1024];
snprintf(config_path, sizeof(config_path), "%s/openssl.cnf", openssldir);
// Load config without path validation
CONF *conf = NCONF_new(NULL);
NCONF_load(conf, config_path, &el);

Patched (hypothetical):

// Hardcoded secure path
const char *secure_openssldir = "C:\ProgramData\Tychon\openssl";
// Verify directory is not user-writable
if (!is_directory_secure(secure_openssldir)) {
    exit(1);
}
char config_path[1024];
snprintf(config_path, sizeof(config_path), "%s/openssl.cnf", secure_openssldir);
// Load config with integrity check
CONF *conf = NCONF_new(NULL);
if (NCONF_load(conf, config_path, &el) <= 0) {
    // Fallback to safe defaults
}

Exploitation & Lab Setup

Red Team (Attacker)

1. Prerequisites: Low-privilege user access on a Windows system running Tychon.
2. Identify OPENSSLDIR: Check environment variables or Tychon configuration for the writable path.
3. Craft malicious openssl.cnf:

   # openssl.cnf
   openssl_conf = malicious_section
   [malicious_section]
   engines = malicious_engine
   [malicious_engine]
   engine_id = malicious
   dynamic_path = C:\Users\Public\malicious.dll
   init = 1
   

4. Place the file: Write the crafted openssl.cnf to the identified OPENSSLDIR (e.g., C:\Users\Public\openssl\openssl.cnf).
5. Trigger execution: Wait for the Tychon service to restart or perform an operation that loads OpenSSL (e.g., certificate validation). The malicious DLL executes with SYSTEM privileges.

Blue Team (Defender)

• Monitor file writes: Alert on creation of openssl.cnf in user-writable directories by non-admin processes.
• Audit Tychon service: Check for unexpected child processes spawned by the Tychon service.
• Harden OPENSSLDIR: Ensure the directory is set to a system-protected location (e.g., C:\ProgramData\Tychon) with proper ACLs.
• Use AppLocker or WDAC: Block execution of unsigned DLLs from user-writable paths.

Indicators of Compromise (IOCs)

• File: openssl.cnf in user-writable directories (e.g., C:\Users\*\AppData\Local\Temp\openssl\openssl.cnf)
• Process: Tychon service (e.g., tychonsvc.exe) spawning cmd.exe, powershell.exe, or other shells.
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\Tychon\Environment with modified OPENSSLDIR.
• Network: Outbound connections from Tychon service to unknown IPs (if DLL performs C2).

Detection Engineering

YARA Rule

rule CVE_2022_4991_openssl_cnf {
    meta:
        description = "Detects malicious openssl.cnf targeting Tychon privilege escalation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-4991"
    strings:
        $s1 = "openssl_conf" ascii wide nocase
        $s2 = "dynamic_path" ascii wide nocase
        $s3 = "engine_id" ascii wide nocase
    condition:
        all of them and filesize < 10KB
}

Sigma Rule

title: Tychon OpenSSL Config File Creation in User-Writable Directory
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of openssl.cnf in user-writable directories, potential CVE-2022-4991 exploitation
author: Valters IT
date: 2025-04-10
tags:
    - attack.privilege_escalation
    - attack.t1068
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\openssl.cnf'
        TargetFilename|contains:
            - '\Users\'
            - '\Temp\'
            - '\AppData\'
    condition: selection
falsepositives:
    - Legitimate OpenSSL configuration by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2022-4991 Tychon OpenSSL Config Exfiltration"; flow:to_server,established; content:"openssl.cnf"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict write permissions to the OPENSSLDIR directory for non-admin users. Set the directory to a system-protected path (e.g., C:\ProgramData\Tychon\openssl) with ACLs allowing only SYSTEM and Administrators.
2. Configuration: Override the OPENSSLDIR environment variable in the Tychon service to a secure path via registry or service configuration.
3. Monitor: Deploy detection rules (YARA, Sigma) to alert on suspicious openssl.cnf creation.
4. Patch: Await an official update from Tychon that hardcodes the OpenSSL configuration path.
5. Workaround: If possible, disable the Tychon service or replace the bundled OpenSSL with a version that ignores user-writable config directories.

Valters IT
Securing digital frontiers with precision.