CVE-2024-12552

Executive Summary

CVE-2024-12552 is a local privilege escalation vulnerability in Wacom Center’s WTabletServicePro.exe. The flaw allows an attacker with low-privileged code execution on the target system to create a symbolic link, abusing the service to write an arbitrary file. This can be leveraged to achieve code execution in the context of SYSTEM. The vulnerability was reported via ZDI (ZDI-CAN-25359) and currently has no known patch or public exploit. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.0 (High)
• Attack Vector: Local (AV:L) – attacker must have local access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: Low (PR:L) – initial foothold needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality, Integrity, Availability: All High (C:H/I:H/A:H) – full system compromise.

Threat Level: High for environments where attackers have local access (e.g., shared workstations, VDI, or post-exploitation scenarios).

Deep Dive & Mechanics

The vulnerability resides in WTabletServicePro.exe, a service component of Wacom Center. The service performs file operations without proper validation of symbolic links. An attacker can create a symbolic link pointing from a location the service writes to (e.g., a temporary file or log) to a critical system file (e.g., C:\Windows\System32\evil.dll). When the service writes to the link, it overwrites the target file, allowing the attacker to plant a malicious DLL or executable that will be loaded by a privileged process.

Attack Flow:

1. Attacker gains low-privileged code execution (e.g., via phishing or another vulnerability).
2. Attacker identifies a writable path used by WTabletServicePro.exe.
3. Attacker creates a symbolic link from that path to a system-protected location (e.g., C:\Windows\System32\drivers\evil.sys).
4. The service writes to the link, placing attacker-controlled content in the privileged location.
5. Attacker triggers loading of the malicious file (e.g., via service restart or system reboot) to gain SYSTEM privileges.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely lacks proper checks for symbolic links before performing file write operations. A patched version would:

• Use CreateFile with FILE_FLAG_OPEN_REPARSE_POINT to avoid following symlinks.
• Validate that the target path is within an expected directory.
• Use impersonation or integrity checks to ensure the caller has appropriate rights.

Vulnerable Code (Conceptual):

// Vulnerable: writes to a path without checking for symlinks
HANDLE hFile = CreateFile(path, GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
WriteFile(hFile, data, size, &written, NULL);
CloseHandle(hFile);

Patched Code (Conceptual):

// Patched: uses FILE_FLAG_OPEN_REPARSE_POINT to avoid following symlinks
HANDLE hFile = CreateFile(path, GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_FLAG_OPEN_REPARSE_POINT, NULL);
if (hFile == INVALID_HANDLE_VALUE) {
    // Handle error or fallback to safe path
}
WriteFile(hFile, data, size, &written, NULL);
CloseHandle(hFile);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local low-privileged access to a Windows system with Wacom Center installed.
• Ability to create symbolic links (requires SeCreateSymbolicLinkPrivilege – often available to standard users on some configurations, or can be bypassed via other techniques).

Exploitation Steps:

1. Identify the writable path used by WTabletServicePro.exe. Common locations include %PROGRAMDATA%\Wacom\ or %TEMP%\Wacom\.
2. Create a symbolic link:

   mklink C:\ProgramData\Wacom\wacom.log C:\Windows\System32\evil.dll
   

3. Trigger the service to write to the link (e.g., by restarting the service or performing a specific action in Wacom Center).
4. The malicious DLL is placed in System32.
5. Execute the DLL via a scheduled task or service to gain SYSTEM shell.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor for creation of symbolic links by non-administrative users, especially to system directories.
• Alert on file writes to C:\Windows\System32\ or C:\Windows\SysWOW64\ by WTabletServicePro.exe.
• Use Sysmon Event ID 7 (Image loaded) to detect loading of unsigned DLLs from unexpected paths.

Hunting:

• Search for symbolic links pointing to system directories:

  Get-ChildItem -Path C:\ProgramData\Wacom\ -Recurse | Where-Object { $_.LinkType -eq 'SymbolicLink' }
  

• Check for recent file modifications in System32 by non-Microsoft processes.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\Wacom\*.log (if symlinked)
  • C:\Windows\System32\evil.dll (or similar)
• Process:
  • WTabletServicePro.exe writing to unexpected paths.
• Registry:
  • Unusual service entries or scheduled tasks referencing evil.dll.
• Network:
  • Outbound connections from SYSTEM context to attacker C2 (post-exploitation).

Detection Engineering

YARA Rule

rule CVE_2024_12552_Wacom_Symlink_Abuse {
    meta:
        description = "Detects symbolic link creation targeting system directories by Wacom Center service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12552"
    strings:
        $s1 = "WTabletServicePro.exe" nocase
        $s2 = "SymbolicLink" nocase
        $s3 = "\\System32\\" nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: Wacom Center Symlink Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects symbolic link creation by Wacom Center service to system directories
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\WTabletServicePro.exe'
        TargetFilename|contains: '\System32\'
    condition: selection
falsepositives:
    - Legitimate Wacom updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-12552 Wacom Center Post-Exploit C2"; flow:to_server,established; content:"evil"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Symbolic Link Creation: Disable SeCreateSymbolicLinkPrivilege for standard users via Group Policy.
2. Monitor Wacom Center: Use EDR to alert on file writes by WTabletServicePro.exe to sensitive directories.
3. Application Control: Whitelist only signed Wacom binaries and block unsigned DLLs in System32.

Long-Term:

• Apply vendor patch when released.
• Consider removing Wacom Center if not essential.
• Implement least privilege for all user accounts.

Workaround:

• Disable the WTabletServicePro service if tablet functionality is not required:

  sc stop WTabletServicePro
  sc config WTabletServicePro start= disabled
  

Valters IT – Securing digital frontiers, one CVE at a time.