exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

PureVPN 5.19.4.0 Privilege Escalation

PureVPN 5.19.4.0 Privilege Escalation
Posted Feb 21, 2018
Authored by DefenseCode, Bosko Stankovic

PureVPN versions 5.19.4.0 and below suffer from a privilege escalation vulnerability.

tags | advisory
SHA-256 | f01935ae5539d9a66d7d09ee0ec64486230558bc46f1e918ef59cf2148cdaa26

PureVPN 5.19.4.0 Privilege Escalation

Change Mirror Download
DefenseCode Security Advisory
PureVPN Windows Privilege Escalation Vulnerability


Advisory ID: DC-2018-02-001
Advisory Title: PureVPN Windows Privilege Escalation Vulnerability
Advisory URL: http://www.defensecode.com/advisories.php
Software: PureVPN
Version: 5.19.4.0 and below (Windows Build Version: 6)
Vendor Status: Vendor contacted, vulnerability fixed
Release Date: 21/02/2018
Risk: MEDIUM



1. General Overview
===================
During the security analysis of PureVPN's Windows client software it
has been discovered that the software contains a vulnerability that
could allow a local user to escalate their privileges on the system.


2. Software Overview
====================
PureVPN is a paid VPN service provider which claims to provide online
privacy and security to its users. The product is equipped with
different tunneling protocols to offer end-to-end encryption to its
users. According to their website, PureVPN's network of 550+ servers
is spread across more than 145 countries, serving over 1 million users
from all over the world.
PureVPN provides client software for Windows, Mac, Android, and iOS.

Homepage:
https://www.purevpn.com


3. Vulnerability Description
============================
During the security analysis of PureVPN Windows client software it
has been determined that the software installation grants Everyone
group (i.e all users) full control permission to the software's
installation directory (C:\Program Files (x86)\PureVPN by default).
In addition, it has been determined that the PureVPNService.exe,
which runs under NT Authority\SYSTEM privileges, tries to load
several dynamic-link libraries using relative paths instead of
the absolute path. When not using a fully qualified path, the
application will first try to load the library from a directory
from which the application is started. As the residing directory
of PureVPNService.exe is writable to all users, this makes the
application susceptible to privilege escalation through DLL hijacking.

DLL hijacking proof of concept was done by placing a malicious
cryptbase.dll inside the software's installation directory,
resulting in privilege escalation to NT Authority\SYSTEM when
the PureVPNService.exe service is started.


4. Solution
===========
Vendor fixed the reported security issues and released a new version.
All users are strongly advised to update to the latest available
version.


5. Credits
==========
Discovered by Bosko Stankovic (bosko@defensecode.com).


6. Disclosure Timeline
======================
02/02/2018 Vendor contacted
13/02/2018 Vendor responded
20/02/2018 Vulnerability fixed


7. About DefenseCode
====================
DefenseCode L.L.C. delivers products and services designed to analyze
and test web, desktop and mobile applications for security
vulnerabilities.

DefenseCode ThunderScan is a SAST (Static Application Security
Testing, WhiteBox Testing) solution for performing extensive security
audits of application source code. ThunderScan SAST performs fast and
accurate analyses of large and complex source code projects delivering
precise results and low false positive rate.

DefenseCode WebScanner is a DAST (Dynamic Application Security
Testing, BlackBox Testing) solution for comprehensive security audits
of active web applications. WebScanner will test a website's security
by carrying out a large number of attacks using the most advanced
techniques, just as a real attacker would.

Subscribe for free software trial on our website
http://www.defensecode.com/ .

E-mail: defensecode[at]defensecode.com

Website: http://www.defensecode.com
Twitter: https://twitter.com/DefenseCode/
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close