CVE-2017-5996 in Remote Support
Summary
by MITRE
The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hijacking because of weak %SYSTEMDRIVE%\ProgramData permissions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/07/2020
The vulnerability identified as CVE-2017-5996 affects Bomgar Remote Support software versions prior to specific patch releases, creating a critical security weakness through improper permission handling on system directories. This issue specifically targets the agent component of the remote support platform, which is designed to facilitate remote access and system administration capabilities for enterprise environments. The vulnerability stems from insufficient access controls on the %SYSTEMDRIVE%\ProgramData directory, a standard Windows location used for storing application data and configuration files that persist across user sessions. This directory structure is commonly utilized by legitimate software applications to store runtime data, temporary files, and shared resources that require elevated privileges to modify.
The technical flaw manifests as a weakness in the permission model governing the ProgramData directory, which allows unprivileged user accounts to manipulate or replace critical dynamic link library files that the Bomgar agent process loads during execution. This creates a classic DLL hijacking scenario where malicious actors can place specially crafted DLL files in the ProgramData directory, causing the Bomgar agent to execute arbitrary code with the privileges of the user account running the agent. The vulnerability operates under the principle that the agent process does not properly validate the integrity or source of dynamically loaded libraries, instead accepting any DLL file that matches the expected naming convention and is located in the search path. This behavior aligns with CWE-427 Uncontrolled Search Path Element, which describes how applications that search for files using paths that include untrusted input can be exploited through directory traversal or file replacement attacks.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to establish persistent access to target systems through the remote support agent. Once exploited, the malicious DLL can maintain access even after the initial compromise, as the Bomgar agent typically runs with elevated privileges and may be configured to start automatically during system boot or user login processes. This vulnerability presents a significant risk to enterprise environments where Bomgar is deployed for remote support operations, as it allows attackers to gain unauthorized access to systems that are often considered trusted and secure due to their legitimate use for remote administration. The attack vector is particularly concerning because it requires minimal user interaction beyond normal system operation, as the agent process automatically loads the malicious DLL when it attempts to access required libraries.
Security professionals should implement immediate mitigations including updating to the patched versions 15.2.3, 16.1.5, and 16.2.4 respectively, which address the weak directory permissions by enforcing proper access controls on the ProgramData directory. Additional protective measures include implementing application whitelisting policies to restrict which DLL files can be loaded by the Bomgar agent, conducting regular security audits of system directories, and monitoring for unusual file creation or modification patterns in the ProgramData folder. The vulnerability also aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as the compromised agent can be used to execute commands and scripts, and T1068 Exploitation for Privilege Escalation, since the initial compromise typically results in elevated system privileges. Organizations should also consider implementing least privilege access controls for the ProgramData directory and regularly reviewing directory permissions to ensure that only authorized processes can modify critical system components.