| Título | Tonec Inc. / Internet Download Manager Corp. Internet Download Manager (IDM) for Windows <= 6.42 Build 63 Exposed IOCTL with Insufficient Access Control |
|---|
| Descrição | Internet Download Manager for Windows installs the `idmwfp.sys` kernel driver, which exposes the `\\.\IDMWFP` device interface to all authenticated users. The device object is created with a security descriptor equivalent to `D:P(A;;GA;;;AU)`, giving authenticated users generic access to the driver interface.
The driver's `IOCTL 0x12C028` handler accepts subcommands `0x0C` through `0x0F` for registry operations. These subcommands decode a user-controlled registry path and value payload, select either `\REGISTRY\MACHINE\` or `\REGISTRY\USER\` based on attacker-controlled flags, and call kernel registry APIs such as `ZwOpenKey`, `ZwCreateKey`, `ZwQueryValueKey`, `ZwSetValueKey`, `ZwDeleteValueKey`, and `ZwDeleteKey`.
The driver does not verify that the caller is authorized to access the target registry path and does not restrict operations to an IDM-owned registry namespace. As a result, a low-privileged local authenticated user can read, create, modify, and delete arbitrary registry values under `HKLM` and `HKU`, and can also delete empty keys.
This primitive can be used to tamper with privileged service or driver configuration under paths such as `HKLM\SYSTEM\CurrentControlSet\Services\...`, alter startup parameters or trusted configuration consumed by high-privilege processes, modify security-related settings, and establish high-privilege persistence. The practical impact is local privilege escalation, system integrity compromise, sensitive configuration disclosure, and denial or degradation of security controls. Attackers can exploit this vulnerability to write the path of a program they want to run with elevated privileges into "SYSTEM\CurrentControlSet\Services\NaturalAuthentication\ImagePath", and then start the service to achieve local privilege escalation.
A working proof of concept is available and can be provided with the submission. |
|---|
| Fonte | ⚠️ https://github.com/KnCRJVirX/IDM_LPE_PoC/tree/main/poc |
|---|
| Utilizador | KnCRJNET (UID 99726) |
|---|
| Submissão | 15/07/2026 16h14 (há 2 meses) |
|---|
| Moderação | 12/09/2026 10h15 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 403081 [Tonec Internet Download Manager até 6.42 Build 63 em Windows Kernel Driver idmwfp.sys Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|