CVE-2024-42050

Executive Summary

CVE-2024-42050 is a privilege escalation vulnerability in the Splashtop Streamer for Windows installer (versions before 3.7.0.0). The MSI installer creates a temporary folder with weak permissions during installation. A local authenticated user can exploit this by placing an oplock on the CredProvider_Inst.reg file within that folder. When the installer processes this file, the oplock triggers, allowing the attacker to intercept the installation process and escalate privileges to SYSTEM. The vulnerability has a CVSS score of 7.0 (High) and is currently unpatched. No public exploit code or PoC is available, but the attack vector is well-understood.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows installer (MSI) issue specific to the Splashtop Streamer software.

CVSS Breakdown & Threat Level

• CVSS Score: 7.0 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is High due to the low complexity and the ability for a local attacker to gain SYSTEM privileges, which can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability lies in the MSI installer's handling of temporary files. During installation, the installer creates a temporary directory with weak permissions (e.g., world-writable). Inside this directory, it places a file named CredProvider_Inst.reg. A local attacker can monitor this directory and place an oplock (opportunistic lock) on the CredProvider_Inst.reg file. When the installer attempts to read or write to this file, the oplock triggers, allowing the attacker to intercept the file operation. The attacker can then replace or modify the file content, leading to arbitrary code execution in the context of the installer, which runs with SYSTEM privileges.

The attack requires the attacker to be logged into the system and to have the ability to create files in the temporary directory. The oplock mechanism is a standard Windows file system feature that allows a process to lock a file and receive notifications when another process accesses it.

Vulnerable vs. Patched Code

Vulnerable Code (Splashtop Streamer < 3.7.0.0): The MSI installer creates a temporary folder with weak permissions (e.g., C:\Windows\Temp\SplashtopStreamer_<random>). The folder is world-writable, and the CredProvider_Inst.reg file is created with default permissions.

// Pseudocode for vulnerable installer behavior
string tempFolder = Path.Combine(Path.GetTempPath(), "SplashtopStreamer_" + Guid.NewGuid().ToString());
Directory.CreateDirectory(tempFolder);
// Weak permissions: Everyone has write access
File.WriteAllText(Path.Combine(tempFolder, "CredProvider_Inst.reg"), regContent);

Patched Code (Splashtop Streamer 3.7.0.0 and later): The patched version uses a secure temporary folder with restricted permissions (only the installer process and SYSTEM can write). Additionally, the installer verifies the integrity of the file before processing.

// Pseudocode for patched installer behavior
string tempFolder = Path.Combine(Path.GetTempPath(), "SplashtopStreamer_" + Guid.NewGuid().ToString());
DirectorySecurity security = new DirectorySecurity();
security.AddAccessRule(new FileSystemAccessRule("SYSTEM", FileSystemRights.FullControl, AccessControlType.Allow));
security.AddAccessRule(new FileSystemAccessRule(WindowsIdentity.GetCurrent().Name, FileSystemRights.FullControl, AccessControlType.Allow));
Directory.CreateDirectory(tempFolder, security);
// Verify file integrity before processing
string filePath = Path.Combine(tempFolder, "CredProvider_Inst.reg");
if (File.Exists(filePath) && VerifyFileSignature(filePath))
{
    // Process file
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Splashtop Streamer < 3.7.0.0 installed.
• Ability to create files in the temporary directory (e.g., C:\Windows\Temp).

Exploitation Steps:

1. Identify the temporary folder created by the installer (e.g., by monitoring file system events).
2. Place an oplock on the CredProvider_Inst.reg file within that folder.
3. When the installer accesses the file, the oplock triggers, allowing the attacker to replace the file with a malicious version.
4. The malicious file can contain commands to create a new user, execute a payload, or modify system settings.

Example Oplock Setup (PowerShell):

# This is a conceptual example; actual exploitation requires a compiled oplock tool
$filePath = "C:\Windows\Temp\SplashtopStreamer_*\CredProvider_Inst.reg"
$oplock = New-Object System.IO.FileStream($filePath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::ReadWrite, [System.IO.FileShare]::None, 4096, [System.IO.FileOptions]::None)
# Wait for oplock break
$oplock.Lock(0, 0)
# Replace file content
Set-Content -Path $filePath -Value "malicious content"
$oplock.Close()

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual file system activity in C:\Windows\Temp during Splashtop Streamer installation.
2. Look for processes creating oplocks on .reg files in temporary directories.
3. Alert on any modification of CredProvider_Inst.reg after initial creation.

Response:

• Immediately isolate the affected system.
• Review logs for unauthorized user creation or privilege escalation.
• Apply the patch by upgrading to Splashtop Streamer 3.7.0.0 or later.

Indicators of Compromise (IOCs)

• File Path: C:\Windows\Temp\SplashtopStreamer_*\CredProvider_Inst.reg
• Registry Key: HKLM\SOFTWARE\Splashtop\Splashtop Streamer
• Process: msiexec.exe (with Splashtop Streamer MSI)
• Event ID: 4656 (A handle to an object was requested) with oplock-related access masks.
• Network: No specific network IOCs; this is a local privilege escalation.

Detection Engineering

YARA Rule

rule CVE_2024_42050_Splashtop_PrivEsc {
    meta:
        description = "Detects Splashtop Streamer installer with weak temp folder permissions"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-42050"
    strings:
        $s1 = "CredProvider_Inst.reg" nocase
        $s2 = "SplashtopStreamer_" nocase
        $s3 = "msiexec" nocase
    condition:
        all of them
}

Sigma Rule

title: Splashtop Streamer Privilege Escalation via Oplock
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects oplock creation on CredProvider_Inst.reg during Splashtop Streamer installation
author: Valters IT
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ObjectName|contains: 'CredProvider_Inst.reg'
        AccessMask|contains: '0x100000'  # Oplock access
    condition: selection
falsepositives:
    - Legitimate system administration tools
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42050 Splashtop Streamer Oplock Exploit"; flow:to_server; content:"CredProvider_Inst.reg"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Splashtop Streamer to version 3.7.0.0 or later.
2. If upgrade is not possible, restrict local user access to the system.
3. Monitor temporary directories for unauthorized file modifications.

Long-Term Mitigations:

• Apply the principle of least privilege to all user accounts.
• Use application whitelisting to prevent unauthorized executables.
• Enable Windows Defender Exploit Guard to block oplock-based attacks.

Patch Details:

• Vendor: Splashtop
• Patch Status: UNKNOWN / UNPATCHED (as of this report)
• Workaround: Manually secure the temporary folder by setting restrictive permissions before installation.

Valters IT
DevSecOps & Cyber Threat Intelligence