Uninstall Key Caching in Fortra Digital Guardian Agent Uninstaller

Title

Uninstall Key Caching

Product

Fortra Digital Guardian Agent Uninstaller

Vulnerable Version

Agent: <7.9.4

Fixed Version

Agent: 7.9.4

CVE Number

CVE-2023-6253

Impact

high

Homepage

https://www.fortra.com/product-lines/digital-guardian

Found

16.05.2023

By

J. Kruchem (Office Vienna), B. Gründling (Office Vienna), D. Hirschberger (Office Bochum) | SEC Consult Vulnerability Lab

The Digital Guardian Management Console is vulnerable to a Stored Cross-Site Scripting attack in the PDF Template functionality. The vendor replied that this is an intended feature. The Digital Guardian Agent Uninstaller File also caches the Uninstall Key which can be extracted by an attacker with administrative privileges and be used to terminate and uninstall the agent.

Vendor description

"Digital Guardian is proud to be part of Fortra’s comprehensive cybersecurity portfolio. Fortra simplifies today’s complex cybersecurity landscape by bringing complementary products together to solve problems in innovative ways. These integrated, scalable solutions address the fast-changing challenges you face in safeguarding your organization. With the help of the powerful protection from Digital Guardian and others, Fortra is your relentless ally, here for you every step of the way throughout your cybersecurity journey."

Source: https://www.digitalguardian.com/

Business recommendation

SEC Consult recommends users of this platform to install the latest update.

Furthermore, an in-depth security analysis performed by security professionals is highly advised, as the software may be affected from other security issues.

Vulnerability overview/description

1) Stored Cross-Site Scripting

The "PDF templates" feature is vulnerable against stored cross-site scripting because it allows inserting arbitrary HTML. Therefore, an administrator can create a malicious template which contains JavaScript and can send a link to this template to authenticated users.

According to the vendor, this feature works as intended and the associated risk is low, hence it will not be fixed.


2) UninstallKey Cached in Memory / Installer File (CVE-2023-6253)

The Agent Uninstaller handles sensitive data insecurely and caches the Uninstall key in memory. This key can be used to stop or uninstall the application. This allows a locally authenticated attacker with administrative privileges to disable the application temporarily or even remove the application from the system completely.

Figure 1
Figure 2

Proof of concept

1) Stored Cross-Site Scripting

According to the vendor, this feature works as intended and the associated risk is low, hence it will not be fixed.

When editing PDF templates in the Digital Guardian Management Console (DGMC) JavaScript code can be injected. By clicking on "preview" the XSS code gets triggered.

The "PDF templates" feature can be found in the System -> Configuration menu. Here, a new template can be uploaded, or an existing one can be edited. To exploit the issue, malicious JavaScript can be added to a template (see Figure 1). Afterwards, the XSS is executed when the template is previewed with the corresponding button (Figure 2).

 The attacker can also send the direct link to the template to the victim:

https:// DG_HOST/DigitalGuardian/PopUps/PDFTemplatePreview.aspx?name=XSS.htm

If a victim opens the link while authenticated, the JavaScript code will be executed.

Figure 3
Figure 4

2) UninstallKey Cached in Memory / Installer File (CVE-2023-6253)

When executing the installer of the DG Agent (.msi) the uninstall key is pre-configured and can be read out (e.g. via Debugging). First, the LocalPackage registry hive was identified, which reveals the MSI installation package located in the Windows directory (Figure 3).

The file can be executed without local administrator privileges. When executed and clicked "Next", the Uninstall Key is prefilled as can be seen in figure 4.

 

Note: For demonstration purposes and simplification of the proof of concept, the provided administrative access to the management console was used to append a unique string to the uninstall key so it can be found in the memory more efficiently. An attacker can also find the key without this modification. For this purpose, the string "sectest" was appended.

WinDbg can be used to extract this key. WinDbg can simply be attached to the process. Afterwards, the execution is paused in WinDbg and the following command is used to search for the unique string:

> s -u 0 L?FFFFFFFFFFFFFFFF "sectest"
Figure 5
Figure 6

Figure 5 shows the output of this command (since a very large memory space is searched, "Break" can be used to stop WinDbg from searching).

The memory space before "sectest" needs to be viewed to show the uninstall key. The command db 000001c6`165b63a8 can be used to show the memory, as can be seen in figure 6.

 

Figure 7

Thus, the original uninstall key is "dlpuninstall".

Furthermore, it can be used with the Terminator.exe found in the following path:

"C:\Program Files\[...]\DLP"

Running the application and supplying the key via an elevated command prompt, it terminates all agent processes (Figure 7).

This binary can also be used to brute-force the correct Uninstall key, by repeatedly calling it with possible Uninstall key candidates:

\.Terminator.exe <key candidate>

 

Vulnerable / tested versions

The following version has been tested:

  • Management Console: 8.5.0.0317
  • Agent: 7.8.5.0048

The vendor confirmed that all current and previous versions are affected.

Vendor contact timeline

2023-06-12 Contacting vendor through email (info@fortra.com); asking for security contact, no response.
2023-06-26 Contacting vendor through same email again, no response.
2023-07-28 Contacting vendor through a more direct email-channel, no response.
2023-09-14 Sent another email to various email addresses found on the website. Their "security.txt" file only points to inaccessible pages (403 Access denied or 404 for the PGP key).
2023-09-14 Vendor response (Fortra support contact) forwarded our email to Digital Guardian support team. Support team and product security team reply.
2023-09-15 Asked for email encryption, received PGP key.
2023-09-18 Sending encrypted security advisory.
2023-09-19 Confirmation of receipt, team is working on verification and development.
2023-10-11 Asking for status update. Vendor response XSS could be replicated but functionality works as intended and won't be fixed because of limited exposure. Issue 2 could not be verified yet, but engineering has acknowledged it as addressable. Fix is planned for Q4. All current and previous versions are affected.
2023-10-12 Asking for CVE number and if further input regarding vulnerability 2 is needed, no response.
2023-10-17 Received ticket notification that next maintenance update version 7.9.4 should be available for customer testing in the near future.
2023-11-09 Received ticket notification that version 7.9.4 is now GA for all customers.
2023-11-13 Sending advisory draft to vendor, asking for CVE number for issue 2 again, scheduling advisory release for next week.
2023-11-17 Vendor response, no CVE number yet, we will request one ourselves.
2023-11-23 Public release of security advisory.

Solution

The vendor provides an updated Agent version 7.9.4 which can be downloaded at the vendor's support page:
https://www.digitalguardian.com/services/support

Access controls to the management console along with monitoring and preventive controls are recommended compensating controls for issue 1 according to the vendor.

Workaround

To prevent disclosure of the uninstall key (issue 2) change it immediately after deploying the DG agent on the system.

Advisory URL

https://sec-consult.com/vulnerability-lab/

EOF J. Kruchem, B. Gründling, D. Hirschberger / @2023

 

Interested to work with the experts of SEC Consult? Send us your application

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices

 

Back