CVE-2023-5993

Executive Summary

CVE-2023-5993 is a local privilege escalation vulnerability in the Windows Installer component of Thales SafeNet Authentication Client, versions prior to 10.8 R10. The flaw allows an authenticated attacker with local access to escalate their privileges to SYSTEM level. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched in older versions. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vulnerability is classified under CWE-269 (Improper Privilege Management) and maps to MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation).

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs initial user-level access.
• User Interaction: None (UI:N) – No user action is needed beyond the attacker's own actions.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – Full system compromise is possible.

Deep Dive & Mechanics

The vulnerability resides in the Windows Installer component of Thales SafeNet Authentication Client. The installer improperly handles privilege escalation during the installation or repair process. Specifically, the installer runs with SYSTEM privileges but fails to validate or restrict operations that can be triggered by a low-privileged user. An attacker can exploit this by crafting a malicious installation or repair request that forces the installer to execute arbitrary code with elevated privileges.

The flaw is rooted in the Windows Installer's custom action or service control logic, which does not enforce proper access control checks. This allows a local user to abuse the installer's high-integrity context to perform actions such as writing to protected system paths, modifying registry keys, or launching processes as SYSTEM.

Vulnerable vs. Patched Code

Vulnerable Code (pre-10.8 R10): The Windows Installer package (MSI) contains custom actions that run with elevated privileges without verifying the caller's identity. For example, a custom action might execute a command or script based on input from the user or environment, but without proper sanitization or impersonation checks.

// Vulnerable pseudo-code
public void CustomAction(Session session)
{
    string command = session["CustomActionData"]; // User-controlled data
    Process.Start(command); // Runs as SYSTEM
}

Patched Code (10.8 R10): The patched version implements proper privilege checks and impersonation. Custom actions now run in the context of the calling user or use secure token verification.

// Patched pseudo-code
public void CustomAction(Session session)
{
    string command = session["CustomActionData"];
    WindowsIdentity identity = WindowsIdentity.GetCurrent();
    if (!identity.IsSystem)
    {
        // Impersonate the calling user
        using (identity.Impersonate())
        {
            Process.Start(command);
        }
    }
    else
    {
        // Log error and abort
        session.Log("Elevated context not allowed for this action");
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Thales SafeNet Authentication Client < 10.8 R10.
• Low-privileged user account.

Exploitation Steps:

1. Identify the vulnerable MSI file (e.g., safenet_authentication_client.msi).
2. Use a tool like msiexec to trigger a repair or custom action that exploits the privilege escalation.
3. Craft a malicious payload (e.g., a reverse shell) and pass it as custom action data.
4. Execute the repair: msiexec /fa safenet_authentication_client.msi CUSTOMACTIONDATA="malicious_command"

Example Payload:

REM Create a new local admin user
net user attacker P@ssw0rd /add
net localgroup Administrators attacker /add

Note: No public exploit code is available; this is a conceptual approach.

Blue Team

Detection:

• Monitor for unusual msiexec processes initiated by non-admin users.
• Look for MSI repair or installation events (Event ID 1033, 1034) triggered by low-privileged accounts.
• Track process creation events where msiexec.exe spawns cmd.exe, powershell.exe, or other shells.

Hunting:

• Search for Event ID 4688 (Process Creation) with ParentProcessName containing msiexec.exe and CommandLine containing suspicious arguments.
• Check for registry modifications under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer by non-admin users.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; generate based on specific MSI version)
• Process Names: msiexec.exe spawned by non-admin user
• Event IDs: 1033, 1034, 4688, 4656 (Object Access)
• Registry Paths: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\*
• Network Connections: Outbound connections from msiexec.exe (if payload downloads additional tools)

Detection Engineering

YARA Rule

rule CVE_2023_5993_Thales_PrivEsc {
    meta:
        description = "Detects exploitation of CVE-2023-5993 in Thales SafeNet Authentication Client"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-5993"
    strings:
        $msi = "safenet_authentication_client.msi" nocase
        $cmd = "CUSTOMACTIONDATA" nocase
        $elevated = "SYSTEM" nocase
    condition:
        $msi and $cmd and $elevated
}

Sigma Rule

title: CVE-2023-5993 - Thales SafeNet Authentication Client Privilege Escalation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2023-5993 via msiexec.exe
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: 'CUSTOMACTIONDATA'
    condition: selection
falsepositives:
    - Legitimate administrative use of custom action data
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2023-5993 - Thales SafeNet Authentication Client Exploit Attempt";
    flow:to_server,established;
    content:"safenet_authentication_client.msi"; nocase;
    content:"CUSTOMACTIONDATA"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Thales SafeNet Authentication Client version 10.8 R10 or later.
2. If upgrade is not possible, restrict local user permissions and disable MSI repair functionality via Group Policy.
3. Monitor and block execution of msiexec.exe by non-admin users using AppLocker or Windows Defender Application Control.

Long-term Measures:

• Implement least privilege principles for all user accounts.
• Regularly audit Windows Installer logs for suspicious activity.
• Apply vendor patches promptly.

Valters IT – Securing your digital frontier.