CVE-2018-7484 in PureVPN
Summary
by MITRE
An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/08/2020
The vulnerability identified as CVE-2018-7484 represents a critical security flaw in PureVPN client software versions up to 5.19.4.0 on Windows operating systems. This issue stems from poor privilege management and insecure coding practices that create a dangerous attack surface for malicious actors seeking to escalate their privileges within the system. The vulnerability manifests through two interconnected weaknesses that together create a path for unauthorized privilege escalation.
The primary flaw involves the installation directory permissions where the Everyone group is granted Full Control access to the PureVPN installation directory. This permission structure violates fundamental security principles by allowing any user account to modify critical system components. According to CWE-276, this represents an insecure default permission configuration that creates an insecure by default condition. The installation process fails to properly implement the principle of least privilege, which is a core requirement in security standards such as those outlined in ISO/IEC 27001 and NIST SP 800-53.
The secondary vulnerability occurs within the PureVPNService.exe service which operates with elevated privileges under the NT Authority\SYSTEM context. This service demonstrates insecure dynamic link library loading behavior by utilizing relative paths instead of absolute paths when loading required libraries. This practice creates a classic DLL hijacking opportunity as defined in the ATT&CK framework under T1056.001 for Input Injection. The service's loading mechanism will first search for libraries in the directory from which the application was started, making the working directory a potential attack vector.
The operational impact of this vulnerability is severe as it enables any local user to escalate privileges to the SYSTEM level. Attackers can exploit this by placing malicious DLL files in the writable installation directory, which will then be loaded by the privileged service when it executes. This creates a privilege escalation pathway that bypasses normal Windows security controls and allows attackers to execute arbitrary code with the highest system privileges. The vulnerability affects not just the local system but also potentially exposes network infrastructure components that rely on the compromised VPN client.
The technical exploitation requires minimal effort as attackers only need to place malicious DLLs in the writable installation directory, which any user can accomplish. The service's behavior of loading libraries from the current working directory creates a race condition that can be reliably exploited. This vulnerability demonstrates the importance of secure coding practices and proper privilege separation, as outlined in the OWASP Secure Coding Practices. Organizations should implement regular security assessments and vulnerability scanning to identify such insecure permission configurations and improper library loading mechanisms that could lead to similar privilege escalation scenarios.
Mitigation strategies should include immediate permission adjustments to restrict write access to the PureVPN installation directory, ensuring that only administrators can modify the installation. The service should be configured to use absolute paths when loading dynamic libraries, and the installation process should be reviewed to eliminate unnecessary permissions for the Everyone group. Additionally, implementing application whitelisting and monitoring for suspicious DLL loading activities can help detect potential exploitation attempts. Regular updates and patch management processes should be enforced to ensure that such insecure configurations are not perpetuated in future installations, as this vulnerability represents a failure in the software development lifecycle security practices.