Exploits / Vulnerability Discovered : 2018-09-18 |
Type : remote |
Platform : windows
This exploit / vulnerability Ubisoft uplay desktop client 63.0.5699.0 remote code execution is for educational purposes only and if it is used you will do on your own risk!
# Vulnerability
# The Uplay desktop client does not properly validate user-controlled data passed to its custom
# uplay URI protocol handler. This flaw can be used to exploit the Chromium Embedded Framework (CEF)
# integrated within the Uplay client, allowing for arbitrary code execution.
# When a victim opens this URI, the string is passed to the Windows ShellExecute function.
# Microsoft states the following: "When ShellExecute executes the pluggable protocol handler with a
# string on the command line, any non-encoded spaces, quotes, and backslashes in the URI will
# be interpreted as part of the command line. This means that if you use C/C++’s argc and
# argv to determine the arguments passed to your application, the string may be broken
# across multiple parameters."
# "Malicious parties could use additional quote or backslash characters to pass additional command
# line parameters. For this reason, pluggable protocol handlers should assume that any parameters on
# the command line could come from malicious parties, and carefully validate them."
# The Uplay desktop client does not properly validate user-controlled data. An attacker can inject
# certain Chromium flags that allow for arbitrary code execution. The malicious URI breaks the
# command line with a quote character and inserts a new switch called --GPU-launcher. Since the
# Uplay client uses the Chromium Embedded Framework (CEF), Chromium command lines switches are supported.
# The --GPU-launcher switch provides a method to execute arbitrary commands. The following string shows
# the final command, which opens the Windows command prompt and executes the whoami program.
# Attack Scenario
# The following attack scenario would result in the compromise of a victim's machine with the vulnerable
# Uplay client installed. A user running Microsoft Edge visits a specially crafted webpage or clicks on a
# specially crafted link. The user is served with the prompt: Did you mean to switch apps? Microsoft Edge
# is trying to open "UPlay launcher". After the user gives consent, the vulnerable application runs,
# resulting in arbitrary code execution in the context of the current process.
# This scenario also works on IE, but the IE browser shows the URI string to be opened and warns users against
# opening untrusted content. Microsoft Edge provides no such warning. Chrome and Firefox both escape
# illegal characters before passing the URI to the protocol handler.
# After Uplay desktop client (upc.exe) is run, upc.exe will attempt to open additional executables
# before the --GPU-launcher is activated. One notable executable is the UplayService.exe. UplayService
# requires elevated privileges. If the user is a non-administrative user a UAC prompt will appear.
# It should be noted, this UAC prompt doesn't prevent command execution from occurring.
# Regardless of which option the user chooses within the UplayService UAC prompt (Yes/No),
# command execution will still occur once the code that passes the --GPU-launcher switch
# to the CEF is triggered within upc.exe.
# Proof of Concept
# The following POC provides two avenues to trigger the vulnerability within Microsoft Edge.
# The first method triggers when the webpage is opened. The second method triggers when the
# hyperlink is clicked by a user.