A vulnerability in the update service command of Cisco WebEx Meetings Desktop App can be exploited using a crafted argument to gain system privileges.
IMPACT: MEDIUM
PUBLISH DATE: 28-11-2018
OVERVIEW
The update service of Cisco Webex Meetings Desktop App for Windows contains a flaw which can be exploited by an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. The vendor has released updates.
ANALYSIS
This is a code injection or an OS command injection vulnerability. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the vulnerability requires local access for an attacker to execute code, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.
The vulnerability can be exploited by copying to a local attacker controller folder, the ptUpdate.exe binary. Also, a malicious dll must be placed in the same folder, named wbxtrace.dll. To gain privileges, the attacker must start the service with the command line: sc start webexservice install software-update 1 “attacker-controlled-path” (if the parameter 1 doesn’t work, then 2 should be used)
PROOF OF CONCEPT
Proof of concept exists for this vulnerability. Follow the link to access it.
https://www.secureauth.com/labs/advisories/cisco-webex-meetings-elevation-privilege-vulnerability
AFFECTED PRODUCTS
Cisco Webex Meetings Desktop App releases prior to 33.6.4
Cisco Webex Productivity Tools releases 32.6.0 and later prior to 33.0.6
(running on a Microsoft Windows end-user system.)
UPDATES
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com for a quick response.