Skip to main content
HDWSec
High CVE-2023-2270

Netskope Client Service Local Privilege Escalation (USER to SYSTEM)

Severity
High
CVSS score
7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE number(s)
CVE-2023-2270
Vendor
Netskope
Product
Netskope Client Service (stAgentSVC) for Windows
Affected version(s)
Windows client versions before R100 (<= 99)
Fixed version(s)
R100
Vulnerability type
Local Privilege Escalation via Zip Slip / Path Traversal (CWE-22)
Researchers
Jean-Jamil KHALIFÉ

Presentation

Netskope is a cloud security platform that provides a complete security solution for companies that use cloud applications, access cloud data and use the Internet for their daily activities. On Windows, the Netskope Client ships two components: a stAgentSVC service running with NT/SYSTEM privileges, and a stAgentUI.exe client running with user privileges that communicates with the service over a local socket.

During a security audit requested by a customer who wanted to know whether their corporate laptops could be compromised, HDW Sec identified several vulnerabilities in the Netskope Client that, when chained together, allow a local low-privileged user to elevate to NT/SYSTEM. The root cause tracked as CVE-2023-2270 is a path-traversal (Zip Slip) flaw in the connection handler, which uses a relative path when downloading and unzipping configuration files, letting a local user place arbitrary files in privileged-only directories.

Issue(s)

The privilege escalation is built by chaining the following weaknesses:

  • Netskope writes a JSON configuration file (nsbranding.json) that is readable and writable by the user. This file holds the URLs Netskope loads when starting the service.
  • A ZIP file is downloaded and extracted by the stAgentSVC service (running as SYSTEM). The extraction is vulnerable to Zip Slip (path traversal), allowing extraction of archive content to arbitrary locations on disk.
  • A DLL can be injected into the Netskope client (stAgentUI.exe) to communicate with the service (stAgentSVC), bypassing the client-path integrity check.
  • netsh.exe can be launched by Netskope with SYSTEM privileges and is vulnerable to DLL side loading (a missing wow64log.dll).

Combining these makes it possible to execute code on the host with SYSTEM privileges.

Full technical analysis

The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20230622-netskope/

References

Our R&D hunts for vulnerabilities.

Zero-day research, reverse engineering, coordinated disclosure: discover our R&D team.

Discover our R&D All publications