CVE-2023-3181

Executive Summary

CVE-2023-3181 is a local privilege escalation vulnerability in Splashtop Streamer’s Software Updater component. The flaw resides in the insecure handling of temporary directories and executable files during the update process. Specifically, the uninstaller (uninst.exe) creates a temporary folder at C:\Windows\Temp~nsu.tmp and copies itself as Au_.exe. This executable is then launched with SYSTEM privileges upon system reboot or during an MSI repair operation. Because the temporary folder inherits weak permissions from C:\Windows\Temp, a standard user can write a malicious DLL into that folder, leading to DLL hijacking and privilege escalation to SYSTEM.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a local software installation issue. The attack vector relies on the insecure default permissions of the Windows Temp directory and the lack of integrity checks on the temporary executable.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability allows a standard user to gain full SYSTEM privileges, compromising the entire host. The attack complexity is low, and no user interaction is required beyond the initial system reboot or MSI repair.

Deep Dive & Mechanics

The vulnerability is a classic case of insecure temporary file creation combined with DLL hijacking. The process flow is as follows:

1. Trigger: The Splashtop Software Updater (uninst.exe) is executed, either manually or as part of an update.
2. Temporary Folder Creation: The process creates a folder at C:\Windows\Temp~nsu.tmp. This folder inherits the permissions of C:\Windows\Temp, which by default allows all authenticated users to write files.
3. Executable Copy: The updater copies itself into this folder as Au_.exe.
4. Privileged Execution: The Au_.exe is configured to run automatically with SYSTEM privileges when the system reboots or when a standard user triggers an MSI repair for Splashtop Streamer.
5. DLL Hijacking: Since Au_.exe is launched from a writable directory, a standard user can place a malicious DLL (e.g., version.dll or dbghelp.dll) into C:\Windows\Temp~nsu.tmp. When Au_.exe loads, it will load the attacker’s DLL instead of the legitimate system DLL, executing arbitrary code with SYSTEM privileges.

Key Weakness: The temporary folder inherits insecure permissions from C:\Windows\Temp, and the executable is not validated before execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable behavior is in the installer/uninstaller logic that creates the temporary folder and copies the executable without setting proper ACLs or verifying the integrity of the executable.

// Vulnerable pseudo-code
CreateDirectory("C:\\Windows\\Temp~nsu.tmp", NULL); // Inherits permissions
CopyFile("uninst.exe", "C:\\Windows\\Temp~nsu.tmp\\Au_.exe", FALSE);
// No ACL hardening or integrity check

Patched Code (Conceptual): A patch would involve creating the temporary folder with restrictive ACLs (e.g., only SYSTEM and Administrators) and verifying the executable’s digital signature before execution.

// Patched pseudo-code
SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(sa);
sa.lpSecurityDescriptor = CreateRestrictedACL(); // Only SYSTEM and Admins
sa.bInheritHandle = FALSE;
CreateDirectory("C:\\Windows\\Temp~nsu.tmp", &sa);
CopyFile("uninst.exe", "C:\\Windows\\Temp~nsu.tmp\\Au_.exe", FALSE);
// Verify digital signature before execution
if (VerifyEmbeddedSignature("C:\\Windows\\Temp~nsu.tmp\\Au_.exe")) {
    // Execute
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Windows system with Splashtop Streamer installed (vulnerable version).
• A standard user account.

Exploitation Steps:

1. Identify the vulnerable process: Ensure the Splashtop Software Updater is present.
2. Prepare the malicious DLL: Create a DLL that will execute a payload (e.g., add a new admin user or spawn a SYSTEM shell). For example, using msfvenom:

   msfvenom -p windows/x64/exec CMD="net user attacker Password123! /add && net localgroup Administrators attacker /add" -f dll -o malicious.dll
   

3. Wait for the temporary folder: Monitor for the creation of C:\Windows\Temp~nsu.tmp. This can be triggered by running the updater or waiting for a system reboot.
4. Drop the malicious DLL: Once the folder appears, copy the malicious DLL into it, naming it to match a DLL that Au_.exe will load (e.g., version.dll).

   copy malicious.dll C:\Windows\Temp~nsu.tmp\version.dll
   

5. Trigger execution: Reboot the system or trigger an MSI repair. The Au_.exe will run as SYSTEM and load the malicious DLL, executing the payload.

Expected Result: The attacker gains a SYSTEM shell or a new admin user.

Blue Team

Detection Steps:

1. Monitor for suspicious temporary folders: Alert on creation of folders matching C:\Windows\Temp~nsu.tmp or similar patterns.
2. Monitor for DLL loading from temporary directories: Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from C:\Windows\Temp~nsu.tmp.
3. Audit file writes to C:\Windows\Temp: Enable SACL auditing on C:\Windows\Temp to log write events by non-admin users.
4. Check for unsigned executables: Verify that Au_.exe is digitally signed by Splashtop.

Hunting Query (KQL):

DeviceEvents
| where ActionType == "DllLoaded"
| where FolderPath startswith "C:\\Windows\\Temp~nsu.tmp"
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName

Indicators of Compromise (IOCs)

• File Paths:
  • C:\Windows\Temp~nsu.tmp\Au_.exe
  • C:\Windows\Temp~nsu.tmp\*.dll (any DLL placed by attacker)
• Process Names:
  • Au_.exe
  • uninst.exe (when creating the temp folder)
• Registry Keys (if persistence is added):
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (if attacker adds persistence)
• Network Connections: None expected, but monitor for outbound connections from Au_.exe if the payload is a reverse shell.

Detection Engineering

YARA Rule

rule CVE_2023_3181_Splashtop_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs in Splashtop temp folder"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-3181"
    strings:
        $s1 = "C:\\Windows\\Temp~nsu.tmp" nocase
        $s2 = "Au_.exe" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Splashtop DLL Hijack via Temp Folder
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DLL loading from Splashtop temporary folder
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        ImageLoaded|startswith: 'C:\Windows\Temp~nsu.tmp\'
    condition: selection
falsepositives:
    - Legitimate Splashtop updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2023-3181 Splashtop DLL Hijack - Potential Outbound Connection";
    flow:to_server,established;
    content:"Au_.exe"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict permissions on C:\Windows\Temp: Ensure only SYSTEM and Administrators have write access. This can be done via Group Policy or manually.
2. Disable the Splashtop Software Updater: If not needed, uninstall or disable the service.
3. Apply vendor patch: Monitor Splashtop’s website for an official patch. As of now, no patch is available.

Long-term Mitigations:

• Application whitelisting: Use AppLocker or WDAC to block execution of unsigned binaries from C:\Windows\Temp.
• Enable Windows Defender Exploit Guard: Use ASR rules to block DLL sideloading.
• Monitor for similar vulnerabilities: Regularly review CVE databases for Splashtop products.

Valters IT
Securing Digital Frontiers