ActFax Local Privilege Escalation

Dimitri Lesy | Sep 22, 2020 min read
ActFax Local Privilege Escalation

ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow Full Control to Everyone. An authenticated local attacker can exploit this to replace the TSClientB.exe binary in the Terminal directory, which is executed on logon for every user. Alternatively, the attacker can replace any of the binaries in the Client or Install directories. The latter requires additional user interaction, for example starting the client.

KeyValue
ProductActFax
VendorActFax Communication-Software GmbH (Krems an der Donau, Austria)
Tested Versions7.10 Build 0335
Fixed Version7.15 Build 0342
Vulnerability TypePrivilege Escalation caused by incorrect default permissions
CVSSv3.1 SeverityCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE ReferenceCWE-276
CVE ReferenceCVE-2020-15843

Proof of Concept

Description of the steps taken in the Proof of Concept video above:

  1. Using an administrative account, ActFax 7.10 Build 0335 is installed.
  2. The administrator logs off.
  3. A regular user (without administrative permissions) logs on. This could be an attacker.
  4. The incorrect folder permissions of the Terminal folder are shown.
  5. The TSClientB.exe binary is replaced with a binary containing a reverse shell to an attacking linux VM.
  6. The user logs off.
  7. A netcat listener is started in the Linux VM.
  8. The administrator logs in once more.
  9. Instead of the original TSClientB.exe the attacker’s EXE-file is launched in the background.
  10. The attacker receives a reverse shell connection from the victim, giving them administrative access to the system.

Remediation

ActFax version 7.15 Build 0342, released on the 14th of September 2020, sets correct permissions on the Terminal, Install, and Client folders for both new and existing installations. The corrected default permissions do not allow Everyone to modify the folders or their contents, therefore mitigating the privilege escalation vulnerability.

Disclosure Timeline

DateEvent
2020-07-07Vulnerability discovered
2020-07-17CVE reserved
2020-07-20Vulnerability reported to the vendor.
2020-07-20Vendor response, a patched version of the software will be released in September.
2020-07-21The vendor supplied a beta version which should fix the problem for both existing and new installations.
2020-07-21Confirmed that the vulnerability no longer exists for the „Terminal“ folder in the beta version.
However, previously overlooked folders with the same issue were found.
2020-07-22Informed the vendor of the previously overlooked folders.
2020-07-28The vendor confirms that they discovered the same issue with the other folders during internal testing.
A beta version mitigating the problem for every folder is made available.
2020-09-03The vendor notified me of the planned release date (2020-09-14).
2020-09-14The vendor released the patched version (7.15 Build 0342).
2020-09-21Advisory published.

I would like to thank the ActFax team for their quick and professional communication through the entire timeline.