CVE-2018-18766
📋 TL;DR
An elevation of privilege vulnerability in Provisio SiteKiosk's Call Dispatcher allows attackers to execute arbitrary code with SYSTEM privileges. This affects all SiteKiosk installations before version 9.7.4905, primarily impacting kiosk systems in public spaces like libraries, museums, and retail environments.
💻 Affected Systems
- Provisio SiteKiosk
📦 What is this software?
Sitekiosk by Provisio
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation leading to kiosk system takeover, potentially enabling unauthorized access to restricted applications or data on the kiosk device.
If Mitigated
Limited impact if proper application whitelisting and user privilege restrictions are implemented, though the vulnerability still exists.
🎯 Exploit Status
Requires local access to the kiosk system. Exploitation details have been publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.7.4905
Vendor Advisory: https://www.provisio.com/en-US/Downloads/VersionHistory.aspx?Product=SiteKiosk
Restart Required: Yes
Instructions:
1. Download SiteKiosk version 9.7.4905 or later from Provisio website. 2. Run the installer on affected systems. 3. Restart the kiosk system to complete installation.
🔧 Temporary Workarounds
Restrict Local Access
allImplement physical security controls to prevent unauthorized local access to kiosk systems.
Application Whitelisting
windowsConfigure Windows AppLocker or similar to restrict execution to approved applications only.
🧯 If You Can't Patch
- Isolate kiosk systems on separate network segments with strict firewall rules
- Implement regular system monitoring and anomaly detection for kiosk devices
🔍 How to Verify
Check if Vulnerable:
Check SiteKiosk version in Help > About SiteKiosk. If version is below 9.7.4905, system is vulnerable.Check Version:
Not applicable - check via SiteKiosk GUI Help > AboutVerify Fix Applied:
Verify version is 9.7.4905 or higher in Help > About SiteKiosk after update.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation events from SiteKiosk
- Privilege escalation attempts in Windows Event Logs
Network Indicators:
- Unexpected outbound connections from kiosk systems
- Network traffic to suspicious destinations
SIEM Query:
EventID=4688 AND ProcessName LIKE '%SiteKiosk%' AND NewProcessName NOT IN (approved_process_list)