what you don't know can hurt you

Pulse Secure Client For Windows Local Privilege Escalation

Pulse Secure Client For Windows Local Privilege Escalation
Posted Jun 16, 2020
Authored by Marco Ortisi, redtimmysec, Giuseppe Cali | Site redtimmy.com

Red Timmy Sec has discovered that Pulse Secure Client for Windows suffers from a local privilege escalation vulnerability in the PulseSecureService.exe service.

tags | advisory, local
systems | windows
advisories | CVE-2020-13162
MD5 | 660c4ebfc56db61522849dc8876a9d7d

Pulse Secure Client For Windows Local Privilege Escalation

Change Mirror Download
Pulse Secure is recognized among the top 10 Network Access Control (NAC) 
vendors by global revenue market share. The company declares that "80%
of Fortune 500 trust its VPN products by protecting over 20 million
users".

At Red Timmy Security we have discovered that Pulse Secure Client for
Windows suffers of a local privilege escalation vulnerability in the
“PulseSecureService.exe” service. Exploiting this issue allows an
attacker to trick “PulseSecureService.exe” into running an arbitrary
Microsoft Installer executable (“.msi”) with SYSTEM privileges, granting
them administrative rights.

The vulnerability lies in the “dsInstallerService” component, which
provides non-administrative users the ability to install or update new
components using installers provided by Pulse Secure. While
“dsInstallerService” performs a signature verification on the content of
the installer, it has been found that it’s possible to bypass the check
providing the service with a legit Pulse Secure installer and swapping
it with a malicious one after the verification

We have registered CVE-2020-13162 for this vulnerability.

Full story here:
https://www.redtimmy.com/privilege-escalation/pulse-secure-client-for-windows-9-1-6-toctou-privilege-escalation-cve-2020-13162/

Disclosure Timeline
-------------------
Vulnerability discovered: April 13th, 2020
Vendor contacted: April 15th, 2020
Vendor's reply: April 17th, 2020
Vendor patch released: May 22nd, 2020
Red Timmy Disclosure: June 16th, 2020

Bug discovered by: Giuseppe Calì
Exploit by: Marco Ortisi & Giuseppe Calì
Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    9 Files
  • 26
    Nov 26th
    11 Files
  • 27
    Nov 27th
    15 Files
  • 28
    Nov 28th
    9 Files
  • 29
    Nov 29th
    2 Files
  • 30
    Nov 30th
    17 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close