| 제목 | Tonec Inc. / Internet Download Manager Corp. Internet Download Manager (IDM) for Windows <= 6.42 Build 63 Exposed IOCTL with Insufficient Access Control |
|---|
| 설명 | Internet Download Manager for Windows installs the `idmwfp.sys` kernel driver, which exposes the `\\.\IDMWFP` device interface to all authenticated users. The device object is created with a security descriptor equivalent to `D:P(A;;GA;;;AU)`, giving authenticated users generic access to the driver interface.
The driver's `IOCTL 0x12C028` handler accepts subcommands `0x0C` through `0x0F` for registry operations. These subcommands decode a user-controlled registry path and value payload, select either `\REGISTRY\MACHINE\` or `\REGISTRY\USER\` based on attacker-controlled flags, and call kernel registry APIs such as `ZwOpenKey`, `ZwCreateKey`, `ZwQueryValueKey`, `ZwSetValueKey`, `ZwDeleteValueKey`, and `ZwDeleteKey`.
The driver does not verify that the caller is authorized to access the target registry path and does not restrict operations to an IDM-owned registry namespace. As a result, a low-privileged local authenticated user can read, create, modify, and delete arbitrary registry values under `HKLM` and `HKU`, and can also delete empty keys.
This primitive can be used to tamper with privileged service or driver configuration under paths such as `HKLM\SYSTEM\CurrentControlSet\Services\...`, alter startup parameters or trusted configuration consumed by high-privilege processes, modify security-related settings, and establish high-privilege persistence. The practical impact is local privilege escalation, system integrity compromise, sensitive configuration disclosure, and denial or degradation of security controls. Attackers can exploit this vulnerability to write the path of a program they want to run with elevated privileges into "SYSTEM\CurrentControlSet\Services\NaturalAuthentication\ImagePath", and then start the service to achieve local privilege escalation.
A working proof of concept is available and can be provided with the submission. |
|---|
| 원천 | ⚠️ https://github.com/KnCRJVirX/IDM_LPE_PoC/tree/main/poc |
|---|
| 사용자 | KnCRJNET (UID 99726) |
|---|
| 제출 | 2026. 07. 15. PM 04:14 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 12. AM 10:15 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 403081 [Tonec Internet Download Manager 까지 6.42 Build 63 켜짐 Windows Kernel Driver idmwfp.sys 권한 상승] |
|---|
| 포인트들 | 20 |
|---|