CVE-2024-0197

Executive Summary

CVE-2024-0197 is a local privilege escalation vulnerability in the installer for Thales SafeNet Sentinel HASP LDK on Windows, affecting versions prior to 9.16. The flaw allows an attacker with local access to escalate their privilege level, potentially gaining SYSTEM or Administrator rights. With a CVSS score of 7.8 (High), this vulnerability poses a significant risk in environments where the software is installed, as it can be exploited by low-privileged users or malware to gain full control of the system. No public proof-of-concept (PoC) or exploit code has been identified at this time, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the lack of a patch for some versions and the local attack vector make it a priority for remediation in sensitive environments.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker must have local access to the system.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – The attacker needs initial low-privileged access.
• User Interaction (UI): None – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – Full disclosure of sensitive data is possible.
• Integrity (I): High – Full control over system files and configurations.
• Availability (A): High – Potential for denial of service or system compromise.

Threat Level: High. The vulnerability is easy to exploit locally and can lead to full system compromise. It is particularly dangerous in multi-user environments or where malware has already gained a foothold.

Deep Dive & Mechanics

The vulnerability resides in the installer for Thales SafeNet Sentinel HASP LDK, a software licensing and protection solution. The installer runs with elevated privileges during the installation process. A flaw in how it handles file operations or registry modifications allows a low-privileged user to manipulate the installation process, leading to privilege escalation.

Technical Details:

• The installer likely creates temporary files or directories with weak permissions, or it may load DLLs from user-writable paths without proper validation.
• An attacker can perform a DLL hijacking or symbolic link attack to inject malicious code that runs in the context of the installer (SYSTEM or Administrator).
• Alternatively, the installer may fail to properly secure its own process or handle user input, allowing a local attacker to execute arbitrary commands with elevated privileges.

Attack Scenario:

1. An attacker gains low-privileged access to a Windows system (e.g., via a compromised user account or malware).
2. The attacker triggers the vulnerable installer (e.g., by running it from a command line or exploiting a scheduled task).
3. The installer performs an action that can be intercepted (e.g., writing to a world-writable directory).
4. The attacker places a malicious DLL or creates a symbolic link in that directory.
5. The installer loads the malicious code, executing it with elevated privileges.
6. The attacker gains SYSTEM or Administrator access.

Vulnerable vs. Patched Code

No specific code diff is publicly available. However, based on the nature of the vulnerability, the patch likely involves:

• Vulnerable: The installer creates temporary files in a user-writable location (e.g., %TEMP%) without proper ACLs, or loads DLLs from the current working directory.
• Patched: The installer uses secure temporary directories with restricted permissions, validates all loaded DLLs against a trusted path, and uses absolute paths for file operations.

Example (Hypothetical):

// Vulnerable code
CreateFile("tempfile.tmp", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
LoadLibrary("helper.dll"); // Loads from current directory

// Patched code
CreateFile("C:\\ProgramData\\SafeNet\\tempfile.tmp", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
LoadLibrary("C:\\Program Files\\SafeNet\\helper.dll"); // Uses absolute path

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-privileged user to SYSTEM.

Prerequisites:

• Local access to a Windows system with SafeNet Sentinel HASP LDK < 9.16 installed.
• Ability to write to a user-writable directory (e.g., %TEMP%).

Exploitation Steps:

1. Identify the vulnerable installer: Locate the installer executable (e.g., setup.exe or HASPInstaller.exe).
2. Monitor file operations: Use Process Monitor (Procmon) to identify temporary file creation or DLL loading.
3. Create a malicious DLL: Write a DLL that executes a reverse shell or adds a user to the Administrators group.

   // malicious.c
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           WinExec("net localgroup Administrators attacker /add", 0);
       }
       return TRUE;
   }
   

4. Perform DLL hijacking: Place the malicious DLL in a directory where the installer will load it (e.g., %TEMP% or the installer's directory).
5. Trigger the installer: Run the installer as a low-privileged user.
6. Escalate: The installer loads the malicious DLL, executing the payload with elevated privileges.

Alternative (Symbolic Link Attack):

• Use mklink to create a symbolic link pointing to a system file, then trigger the installer to overwrite it.

Blue Team

Detection:

• Monitor for unusual file creation in %TEMP% or %PROGRAMDATA% by installer processes.
• Alert on DLL load events from non-standard paths (e.g., %TEMP%).
• Use Sysmon to log process creation and file events.

Hunting:

• Search for events where setup.exe or HASPInstaller.exe loads DLLs from user-writable directories.
• Look for symbolic link creation (mklink) by low-privileged users.

Prevention:

• Apply the patch (upgrade to version 9.16).
• Restrict write access to %TEMP% for non-administrators.
• Use AppLocker or Windows Defender Application Control to block untrusted DLLs.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None publicly available; generate during analysis)
• Process Names: setup.exe, HASPInstaller.exe, HASPInstaller64.exe
• File Paths: %TEMP%\*.tmp, %PROGRAMDATA%\SafeNet\*
• Registry Keys: HKLM\SOFTWARE\SafeNet\Sentinel\*
• Network: Outbound connections from installer processes (if payload is a reverse shell)
• Behavior: DLL load events from %TEMP% or %USERPROFILE% by installer processes.

Detection Engineering

YARA Rule

rule CVE_2024_0197_Installer_PrivEsc {
    meta:
        description = "Detects potential exploitation of CVE-2024-0197 via malicious DLL in temp directory"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "SafeNet" nocase
        $s2 = "Sentinel" nocase
        $s3 = "HASP" nocase
        $s4 = "temp" nocase
        $s5 = "DllMain" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (pe.imphash() == "unknown") and
        (1 of ($s1, $s2, $s3)) and
        ($s4 or $s5)
}

Sigma Rule

title: CVE-2024-0197 - SafeNet Sentinel HASP LDK Local Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-0197 via DLL hijacking or symbolic link attacks
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\setup.exe'
            - '\HASPInstaller.exe'
            - '\HASPInstaller64.exe'
        CommandLine|contains:
            - 'temp'
            - 'symbolic'
    condition: selection
falsepositives:
    - Legitimate installer operations
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-0197 - Potential SafeNet Installer Outbound Connection"; flow:to_server,established; content:"SafeNet"; nocase; content:"Sentinel"; nocase; content:"HASP"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update SafeNet Sentinel HASP LDK to version 9.16 or later.
2. Restrict Access: Limit local user permissions to prevent exploitation.
3. Monitor: Enable logging for process creation and file events.

Long-Term Measures:

• Implement least privilege principles.
• Use application whitelisting to block unauthorized executables.
• Regularly audit installed software for vulnerabilities.

Workaround (if patching is not possible):

• Remove the installer from systems after installation.
• Use Group Policy to block execution of the installer by non-administrators.

Valters IT