CVE-2024-0819

Executive Summary

CVE-2024-0819 is a privilege escalation vulnerability in TeamViewer Remote Client for Windows, Linux, and macOS. The flaw stems from improper initialization of default settings, allowing a low-privileged user to elevate their privileges by manipulating the personal password setting and establishing a remote connection to a logged-in admin account. With a CVSS score of 7.3, this vulnerability poses a significant risk to organizations using TeamViewer for remote support, as it can lead to full system compromise. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is straightforward and requires only local access.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact on confidentiality, integrity, and availability, combined with low attack complexity and no user interaction, makes this a critical vulnerability for environments where TeamViewer is deployed with default settings.

Deep Dive & Mechanics

The vulnerability lies in how TeamViewer Remote Client initializes its default settings. When a low-privileged user installs or configures the client, the personal password setting is not properly initialized. This allows the attacker to set a personal password for the TeamViewer instance without proper authorization. Once set, the attacker can use this password to establish a remote connection to a machine where an admin is logged in. Since the admin session has higher privileges, the attacker effectively gains elevated access.

The core issue is a failure to enforce proper access controls during the initialization of security-sensitive settings. The personal password is intended to allow unattended access, but the default state should be disabled or require admin-level confirmation. Instead, the client allows any local user to modify this setting, leading to privilege escalation.

Vulnerable vs. Patched Code

The vulnerable code path involves the initialization of the personal password setting. In versions prior to 15.51.5, the setting is not properly locked down, allowing modification by low-privileged users.

Vulnerable Code (Conceptual):

// Insecure initialization
void InitializeSettings() {
    // Personal password is not protected
    settings.personalPassword = "";
    settings.allowRemoteAccess = false;
    // No access control check
}

Patched Code (Conceptual):

// Secure initialization with access control
void InitializeSettings() {
    // Personal password is protected
    settings.personalPassword = "";
    settings.allowRemoteAccess = false;
    // Only admin can modify
    if (GetCurrentUserPrivilege() != ADMIN) {
        return ACCESS_DENIED;
    }
}

The patch ensures that only users with administrative privileges can modify the personal password setting, preventing low-privileged users from exploiting it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• TeamViewer Remote Client version < 15.51.5 installed on a target machine.
• Low-privileged user access to the target machine.
• An admin user logged into the same machine.

Steps:

1. Set Personal Password: As a low-privileged user, open TeamViewer and navigate to Extras > Options > Security. Set a personal password for unattended access.
2. Establish Remote Connection: From an attacker-controlled machine, use the TeamViewer client to connect to the target machine using the set personal password.
3. Escalate Privileges: Once connected, the attacker will have the privileges of the logged-in admin user, allowing full control over the system.

Example Command (PowerShell):

# Set personal password via registry (if accessible)
Set-ItemProperty -Path "HKCU:\Software\TeamViewer" -Name "PersonalPassword" -Value "attacker_password"

Blue Team

Detection:

• Monitor for unauthorized changes to TeamViewer settings, especially the personal password.
• Alert on remote connections initiated from unexpected IP addresses or during off-hours.
• Use endpoint detection and response (EDR) tools to detect anomalous TeamViewer processes.

Prevention:

• Apply the vendor patch immediately.
• Restrict local user permissions to modify TeamViewer settings via Group Policy.
• Disable unattended access for non-admin users.

Indicators of Compromise (IOCs)

• Registry Key Modification: HKCU\Software\TeamViewer\PersonalPassword changed by a non-admin user.
• Process Anomalies: TeamViewer.exe running with elevated privileges after a low-privileged user session.
• Network Connections: Outbound connections to TeamViewer relay servers from a machine where an admin is logged in.
• Event Logs: Windows Security Event ID 4688 (Process Creation) showing TeamViewer.exe launched by a low-privileged user.

Detection Engineering

YARA Rule

rule CVE_2024_0819_TeamViewer_PrivEsc {
    meta:
        description = "Detects TeamViewer personal password modification by low-privileged user"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0819"
    strings:
        $s1 = "PersonalPassword" ascii wide nocase
        $s2 = "TeamViewer" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: TeamViewer Personal Password Modification by Non-Admin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects when a low-privileged user modifies the TeamViewer personal password setting.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0819
author: Valters IT
date: 2024-01-01
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: 'HKCU\Software\TeamViewer\PersonalPassword'
        EventType: SetValue
    condition: selection
falsepositives:
    - Admin users legitimately changing settings
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0819 TeamViewer Unauthorized Remote Connection"; flow:to_server,established; content:"TeamViewer"; nocase; content:"PersonalPassword"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch Immediately: Upgrade TeamViewer Remote Client to version 15.51.5 or later.
2. Restrict Local Permissions: Use Group Policy to prevent non-admin users from modifying TeamViewer settings.
3. Disable Unattended Access: For non-admin users, disable the unattended access feature.
4. Monitor Logs: Enable auditing for registry changes and process creation related to TeamViewer.
5. Network Segmentation: Limit outbound connections from TeamViewer to trusted IPs only.

Valters IT
Securing Digital Frontiers