The latest official version is 5.2.7, released prior to Safebreach's notification to Maxthon, and included by SafeBreach as among the affected versions (5.1.0 to 5.2.7). While this should be a simple fix, we do not at this time have confirmation on whether it has or when it will be fixed by Maxthon. The serviceit just executes the malicious executable once it is started." No suspicious action is required by the attacker. "This way," warn the researchers, "the malicious payload might not be detected by security products, because the service process which executes the attacker’s payload is signed, and executes it 'natively'. Without being fixed, however, a malicious payload gains persistence by being loaded every time the browser is restarted. The solution is specified in the CreateServiceW function documentation in MSDN: "If the path contains a space, it must be quoted so that it is correctly interpreted." Because of the space between 'Program' and 'Files' in the specified path, the entire path should have been, but was not, contained in double quotes. It is a simple coding error that should be easily fixable. "Program Files" is firstly 'Program' (which it doesn't find), and then 'Program.exe' (which it either doesn't find or finds a potentially malicious insertion instead). The CreateServiceW function doesn’t know whether it’s part of the path or whether it’s an argument, and tries to parse the first word. The final path includes 'Program Files' (containing a space). However, the path is not a quoted string. sprintf is called to format the buffer containing the path of the service executable. The basic cause of the problem lies in the Maxthon browser installation phase. By simply dropping their own 'program.exe' as a PoC, the researchers demonstrated that their unsigned payload still ran as NT AUTHORITY\SYSTEM, providing scope for further privilege escalation. The problem occurs because services.exe looks for a file it cannot find (program.exe). And it starts automatically on system boot, providing a persistence mechanism. It is signed by Maxthon Technology Co, Ltd, so any malicious payload executed by MxService gets an application whitelisting bypass.
Maxthon browser software#
The vulnerability occurs because part of the Maxthon software - including MxService.exe - runs as 'NT AUTHORITY\SYSTEM', giving it powerful permissions and capabilities. Neither the timeline nor confirmation that the fix is effective have been published. SafeBreach has reported the vulnerability to Maxthon, who has confirmed receipt and provided a timeline for a fix. Exploitation requires administrator privileges, but post exploitation it can be used to achieve privilege escalation, persistence and in some cases defense evasion. The vulnerability was discovered by researchers at SafeBreach Labs, and has been designated the reference CVE-2019-16647. Maxthon claims to be the default browser for 670 million worldwide users. Maxthon is a freeware browser developed by Maxthon Ltd, a firm headquartered in Beijing, China, and with offices in San Francisco, CA. Researchers have discovered a vulnerability in the Maxthon 5 Browser for Windows.
0 kommentar(er)
