CVE-2024-42053 in Streamer
Summary
by MITRE • 07/28/2024
The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a version.dll file in the folder.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/15/2025
The vulnerability identified as CVE-2024-42053 affects the Splashtop Streamer for Windows installer version prior to 3.6.0.0, representing a critical privilege escalation flaw that stems from improper temporary file handling during the installation process. This issue falls under the broader category of insecure temporary file creation and manipulation, which is categorized as CWE-377 in the Common Weakness Enumeration framework. The installer creates temporary files in a location where local users possess write permissions, creating an exploitable condition that allows arbitrary code execution with elevated privileges.
During the installation process, the Splashtop Streamer installer utilizes a temporary directory that lacks proper access controls, specifically allowing local users to write files to this location. This weakness enables an attacker to place a malicious version.dll file in the temporary folder, which the installer subsequently loads and executes. The vulnerability is particularly dangerous because it leverages the installer's trust in the temporary directory's contents, allowing a local user to inject malicious code that gets executed with the privileges of the installer process. The installer process typically runs with elevated privileges, making this a direct path to SYSTEM-level access.
The operational impact of this vulnerability is severe as it allows any local user to escalate their privileges without requiring additional authentication or complex exploitation techniques. The attack vector is straightforward and requires only local access to the system, making it particularly concerning for environments where local privilege escalation is not typically expected. This vulnerability can be exploited by an attacker who has already gained access to a low-privilege account, potentially allowing them to gain complete system control. The exploitability is further enhanced by the fact that the installer is likely to be run by system administrators or users with elevated privileges during normal operations, increasing the likelihood of successful exploitation.
The recommended mitigation for this vulnerability involves upgrading to Splashtop Streamer version 3.6.0.0 or later, which addresses the weak permissions issue in the temporary folder handling. System administrators should also implement proper access controls on temporary directories and ensure that only authorized processes can write to these locations. Additionally, the principle of least privilege should be enforced during installation processes, ensuring that installers do not run with unnecessary elevated privileges. This vulnerability aligns with ATT&CK technique T1068, which covers privilege escalation through local exploitability, and demonstrates how installer-based vulnerabilities can be leveraged to achieve system-level compromise. Organizations should also consider implementing application whitelisting policies to prevent unauthorized DLL loading and monitor for suspicious file creation patterns in temporary directories.