Horizontal Privilege Escalation/Code Injection in ownCloudâ??s Windows Client Aug 19 2016 07:20AM
Florian Bogner (florian bogner sh)
Horizontal Privilege Escalation/Code Injection in ownCloudâ??s Windows Client

Release Date: 17-08-2016
Author: Florian Bogner @ Kapsch BusinessCom AG (https://www.kapsch.net/kbc)
Affected versions: up to ownCloud's Desktop client version 2.2.2
Tested on: Windows 7 64 bit
CVE : pending
URL: https://bogner.sh/2016/08/horizontal-privilege-escalation-in-ownclouds-w
Video: https://www.youtube.com/watch?v=KytWLsrjyVk
Vulnerability Status: Fixed in version 2.2.3 (oc-sa-2016-016)

The ownCloud Windows Desktop client (up to version 2.2.2) is prone to an arbitrary code injection vulnerability leading to code execution in other user's Windows sessions.
The issue is that QT extensions are loaded from C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins.
As any authenticated user on Windows is allowed to create new folders within C:, the expected folder structure can be created.
That means that any local attacker can create a malicious QT extensions that gets automatically loaded on the next launch of the ownCloud Desktop client in any local Windows session.

1.) Download the modified QT platform's library qwindow.dll: https://bogner.sh/wp-content/uploads/2016/08/qwindows.dll_.zip
2.) Place it into C:\usr\i686-w64-mingw32\sys-root\mingw\lib\qt5\plugins\platforms
3.) Start the ownCloud Desktop Client: The "malicious" code is executed and a message box is opened

Disclosure Timeline
31.7.2016: The issues have been documented and reported
4.8.2016: ownCloud verified the issue and started to work on a fix
5.8.2016: Patch has been developed and I verified that the issue has been fixed
8.8.2016: ownCloud Desktop Client 2.2.3 with the fix has been publicly released
17.8.2016: ownCloud Security Advisory oC-SA-2016-016 has been published
17.8.2016: Public disclosure

Suggested Solution
Install the latest available version from https://owncloud.org/install

Florian Bogner

eMail: florian (at) bogner (dot) sh [email concealed]
Web: http://www.bogner.sh
LinkedIn: https://www.linkedin.com/profile/view?id=368904276
Xing: https://www.xing.com/profile/Florian_Bogner9

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus