CVE-2023-6335

Executive Summary

CVE-2023-6335 is a high-severity local privilege escalation vulnerability in HYPR Workforce Access on Windows, stemming from an improper link resolution before file access (CWE-59). An authenticated attacker with low privileges can exploit a symbolic link following attack to delete or overwrite arbitrary files, potentially leading to system compromise. The vulnerability affects all versions prior to 8.7. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the local attack vector and the potential for privilege escalation, this vulnerability should be prioritized for patching in environments where HYPR Workforce Access is deployed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.4 (Medium)
• Attack Vector: Local (AV:L) – Requires physical or remote access to the system.
• Attack Complexity: High (AC:H) – Exploitation requires specific conditions, such as a race condition or user interaction.
• Privileges Required: Low (PR:L) – Attacker needs a standard user account.
• User Interaction: Required (UI:R) – Victim must perform an action (e.g., open a file or run a process).
• Scope: Unchanged (S:U) – Vulnerability does not cross security boundaries.
• Confidentiality Impact: High (C:H) – Potential for unauthorized file read.
• Integrity Impact: High (I:H) – Potential for unauthorized file modification or deletion.
• Availability Impact: High (A:H) – Potential for system crash or denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and file system manipulation makes this a serious concern for enterprise deployments.

Deep Dive & Mechanics

The vulnerability resides in how HYPR Workforce Access handles file operations on Windows. The software creates temporary files or accesses configuration files using a predictable path or name. An attacker with low privileges can create a symbolic link (symlink) pointing from the expected file location to a target file (e.g., a system DLL or a privileged configuration file). When the HYPR service or application performs a file operation (e.g., write, delete, or rename) on the expected path, it inadvertently follows the symlink and performs the operation on the target file.

Key Technical Details:

• CWE-59: Improper Link Resolution Before File Access ('Link Following') – The software does not check if the target is a symbolic link before performing file operations.
• Attack Vector: Local, requiring the attacker to have a user account on the same machine.
• Prerequisite: The attacker must be able to create symbolic links (usually requires SeCreateSymbolicLinkPrivilege, which is often granted to standard users in some configurations).
• Impact: Arbitrary file deletion, overwrite, or read, potentially leading to privilege escalation (e.g., overwriting a system binary or DLL).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-8.7): The vulnerable code likely uses a function like CreateFile or DeleteFile without first checking if the path is a symbolic link. For example:

// Vulnerable: No symlink check
HANDLE hFile = CreateFile(
    L"C:\\ProgramData\\HYPR\\temp\\update.dat",
    GENERIC_WRITE,
    0,
    NULL,
    CREATE_ALWAYS,
    FILE_ATTRIBUTE_NORMAL,
    NULL);
if (hFile != INVALID_HANDLE_VALUE) {
    // Write data
    CloseHandle(hFile);
}

Patched Code (8.7+): The patched version likely uses CreateFile with the FILE_FLAG_OPEN_REPARSE_POINT flag to prevent following symlinks, or explicitly checks the file attributes before access:

// Patched: Use FILE_FLAG_OPEN_REPARSE_POINT to avoid symlink following
HANDLE hFile = CreateFile(
    L"C:\\ProgramData\\HYPR\\temp\\update.dat",
    GENERIC_WRITE,
    0,
    NULL,
    CREATE_ALWAYS,
    FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT,
    NULL);
if (hFile != INVALID_HANDLE_VALUE) {
    // Write data
    CloseHandle(hFile);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows machine with HYPR Workforce Access < 8.7 installed.
• Low-privileged user account.
• Ability to create symbolic links (may require enabling SeCreateSymbolicLinkPrivilege for standard users via local policy).

Exploitation Steps:

1. Identify a vulnerable file operation: Monitor the HYPR service (e.g., HYPRService.exe) for file creation/deletion in a predictable location (e.g., C:\ProgramData\HYPR\temp\).
2. Create a symbolic link: Use mklink to create a symlink from the expected file to a target (e.g., C:\Windows\System32\evil.dll).

   mklink C:\ProgramData\HYPR\temp\update.dat C:\Windows\System32\evil.dll
   

3. Trigger the operation: Cause the HYPR service to perform the file operation (e.g., by initiating an update or restarting the service).
4. Escalate privileges: If the target is a system DLL or executable, the next time the system loads it, the attacker's code executes with SYSTEM privileges.

Note: No public exploit code is available. This is a theoretical exploitation path based on CWE-59.

Blue Team (Detection & Prevention)

Detection:

• Monitor for symbolic link creation events (Event ID 4663 – An attempt was made to access an object) with SYMBOLIC_LINK type.
• Monitor file operations in HYPR directories for unexpected targets.
• Use Sysmon to log file creation and symlink events.

Prevention:

• Apply the patch (upgrade to version 8.7 or later).
• Restrict SeCreateSymbolicLinkPrivilege to administrators only.
• Use Windows Defender Application Control (WDAC) to block untrusted binaries.
• Enable Windows Defender Exploit Guard (ASR rules) to block Office apps from creating child processes.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\HYPR\temp\*.dat (suspicious symlinks)
  • C:\Program Files\HYPR\* (modified binaries)
• Registry Keys:
  • HKLM\SOFTWARE\HYPR\* (unexpected modifications)
• Processes:
  • HYPRService.exe (unexpected file access patterns)
• Event Logs:
  • Windows Security Event ID 4663 (Object Access) with SYMBOLIC_LINK type.
  • Sysmon Event ID 11 (FileCreate) for symlink creation.

Detection Engineering

YARA Rule

rule CVE_2023_6335_Symlink_Exploit {
    meta:
        description = "Detects symbolic link creation targeting HYPR directories"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6335"
    strings:
        $symlink_cmd = "mklink" nocase
        $hypr_path = "C:\\ProgramData\\HYPR" nocase
        $hypr_path2 = "C:\\Program Files\\HYPR" nocase
    condition:
        $symlink_cmd and ($hypr_path or $hypr_path2)
}

Sigma Rule

title: CVE-2023-6335 - HYPR Symlink Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects symbolic link creation targeting HYPR directories
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6335
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectType: 'SYMBOLIC_LINK'
        ObjectName|contains: 'HYPR'
    condition: selection
falsepositives:
    - Legitimate HYPR updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6335 - HYPR Symlink Exploit"; flow:to_server,established; content:"mklink"; nocase; content:"HYPR"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade HYPR Workforce Access to version 8.7 or later.
2. Workaround: If patching is not possible, restrict the SeCreateSymbolicLinkPrivilege to administrators only via Group Policy.
3. Monitor: Enable auditing for symbolic link creation and file access in HYPR directories.

Long-Term Mitigations:

• Implement the principle of least privilege for all user accounts.
• Use application whitelisting (e.g., WDAC) to prevent unauthorized binaries.
• Regularly review and update security policies for symbolic link creation.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.