Veyon Service 安全漏洞
漏洞ID |
2200835 |
漏洞类型 |
代码问题 |
发布时间 |
2021-07-11 |
更新时间 |
2021-07-11 |
CVE编号 |
CVE-2020-15261 |
CNNVD-ID |
CNNVD-202010-902 |
漏洞平台 |
N/A |
CVSS评分 |
N/A |
|漏洞详情
Veyon Service是个人开发者的一款用于Windows和Linux的计算机监控和教室管理软件。该软件可使教师可以查看和控制计算机实验室并与学生互动。 Veyon Service 4.4.2之前版本存在安全漏洞,该漏洞源于一个未引用的服务路径漏洞,攻击者可利用该漏洞使用LocalSystem特权运行恶意的可执行文件。
|漏洞EXP
# Exploit Title: Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
# Discovery by: Víctor García
# Discovery Date: 2020-03-23
# Vendor Homepage: https://veyon.io/
# Software Link: https://github.com/veyon/veyon/releases/download/v4.4.1/veyon-4.4.1.0-win64-setup.exe
# Tested Version: 4.4.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro x64
# CVE: CVE-2020-15261
# Step to discover Unquoted Service Path:
C:\>wmic service get name,displayname,pathname,startmode |findstr /i
"auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
Veyon Service VeyonService C:\Program Files\Veyon\veyon-service.exe
# Service info:
C:\>sc qc VeyonService
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: VeyonService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Veyon\veyon-service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Veyon Service
DEPENDENCIES : Tcpip
: RpcSs
SERVICE_START_NAME : LocalSystem
# Exploit:
# A successful attempt would require the local user to be able to insert their code in the
# system root path undetected by the OS or other security applications where it could
# potentially be executed during application startup or reboot. If successful, the local
# user's code would execute with the elevated privileges of the application.
|参考资料
来源:CONFIRM
链接:https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp
来源:MISC
链接:https://github.com/veyon/veyon/issues/657
来源:MISC
链接:https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1
来源:nvd.nist.gov
链接:https://nvd.nist.gov/vuln/detail/CVE-2020-15261
本文由 华域联盟 原创撰写:华域联盟 » Veyon Service 安全漏洞
转载请保留出处和原文链接:https://www.cnhackhy.com/89264.htm
本文来自网络,不代表华域联盟立场,转载请注明出处。