Horizontal Privilege Escalation/Code Injection in ownCloud’s Windows Client Metadata =================================================== Release Date: 17-08-2016 Author: Florian Bogner @ Kapsch BusinessCom AG (https://www.kapsch.net/kbc) Affected versions: up to ownCloud's Desktop client version 2.2.2 Tested on: Windows 7 64 bit CVE : pending URL: https://bogner.sh/2016/08/horizontal-privilege-escalation-in-ownclouds-windows-client/ Video: https://www.youtube.com/watch?v=KytWLsrjyVk Vulnerability Status: Fixed in version 2.2.3 (oc-sa-2016-016) Description =================================================== The ownCloud Windows Desktop client (up to version 2.2.2) is prone to an arbitrary code injection vulnerability leading to code execution in other user's Windows sessions. The issue is that QT extensions are loaded from C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins. As any authenticated user on Windows is allowed to create new folders within C:, the expected folder structure can be created. That means that any local attacker can create a malicious QT extensions that gets automatically loaded on the next launch of the ownCloud Desktop client in any local Windows session. PoC =================================================== 1.) Download the modified QT platform's library qwindow.dll: https://bogner.sh/wp-content/uploads/2016/08/qwindows.dll_.zip 2.) Place it into C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins\platforms 3.) Start the ownCloud Desktop Client: The "malicious" code is executed and a message box is opened Disclosure Timeline =================================================== 31.7.2016: The issues have been documented and reported 4.8.2016: ownCloud verified the issue and started to work on a fix 5.8.2016: Patch has been developed and I verified that the issue has been fixed 8.8.2016: ownCloud Desktop Client 2.2.3 with the fix has been publicly released 17.8.2016: ownCloud Security Advisory oC-SA-2016-016 has been published 17.8.2016: Public disclosure Suggested Solution =================================================== Install the latest available version from https://owncloud.org/install Florian Bogner eMail: florian@xxxxxxxxx Web: http://www.bogner.sh LinkedIn: https://www.linkedin.com/profile/view?id=368904276 Xing: https://www.xing.com/profile/Florian_Bogner9
