After patching set of issues reported by Trustwave SpiderLabs last month, Lenovo released another version of its Lenovo Solution Center software to address new security holes. Specifically, we at Trustwave SpiderLabs found that the new version (3.3.002), even though significantly reworked, still allowed unprivileged users to elevate privileges to LocalSystem.
When an unprivileged user starts the LSC.Services.SystemService, it can pass arguments to the service. By design, this service expects three arguments which it interprets as named pipe name, mutex name and a process ID. The service permissions are set so that anyone can start and stop it.
When the service starts, it starts a small TCP server on a random port and uses the named pipe to send the server IP:PORT pair back. If an attacker prepares his own named pipe server and then starts the LSC.Services.SystemService, he will get TCP endpoint information to connect to.
It turns out that the TCP server provides several APIs, including one to load .NET assemblies from disk. Lenovo intended this API to load assemblies under the trusted path only. In reality it will load any .NET assembly on the same partition where the Lenovo Solution Center software is installed if a directory traversing pattern is used.
Considering the fact that the TCP server runs as LocalSystem account, attacker can load .NET assembly into a privileged process. This could be used to elevate privileges easily by referencing malicious assemblies placed in public folders which will execute code on loading for instance.
Trustwave SpiderLabs has worked closely with Lenovo to report and help address this issue. Thanks to Lenovo for their open communication and speedy response.
Please find complete proof-of-concept on SpiderLabs github site: https://github.com/SpiderLabs/advisories-poc/tree/master/cve-2016-5249
Please see our advisory for full details: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18782
A new version of the software is available for download from Lenovo's site: https://support.lenovo.com/us/en/product_security/len_7814