CVE-2021-28269
📋 TL;DR
Soyal Technology 701Client 9.0.1 has insecure file permissions on its client.exe binary, granting the Authenticated Users group full control. This allows authenticated attackers to replace or modify the executable, potentially leading to privilege escalation or arbitrary code execution. Organizations using this specific version of Soyal 701Client are affected.
💻 Affected Systems
- Soyal Technology 701Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers replace client.exe with malicious code, gaining SYSTEM-level privileges and complete control over the system, potentially leading to domain compromise.
Likely Case
Authenticated users replace the binary to gain elevated privileges, install backdoors, or execute arbitrary code with higher permissions.
If Mitigated
With proper permissions hardening, only authorized administrators can modify the binary, preventing exploitation.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once access is obtained. Public exploit code demonstrates the permission issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
No official patch available. Apply workarounds to secure file permissions.
🔧 Temporary Workarounds
Secure client.exe permissions
windowsRemove Full Control permissions from Authenticated Users group on client.exe binary
icacls "C:\Program Files\Soyal\701Client\client.exe" /remove "Authenticated Users"
icacls "C:\Program Files\Soyal\701Client\client.exe" /grant "Administrators:(F)"
🧯 If You Can't Patch
- Restrict access to systems running 701Client to only authorized users
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check permissions on client.exe: icacls "C:\Program Files\Soyal\701Client\client.exe" and look for 'Authenticated Users:(F)'Check Version:
Check program version in Control Panel > Programs and Features or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallVerify Fix Applied:
Verify Authenticated Users no longer have Full Control permissions on client.exe📡 Detection & Monitoring
Log Indicators:
- Windows Security event logs showing file permission changes on client.exe
- Process creation events for unexpected binaries
Network Indicators:
- Unusual network connections from 701Client systems
- Traffic to unexpected destinations
SIEM Query:
EventID=4663 AND ObjectName="*client.exe" AND Accesses="WRITE_DAC" OR Accesses="WRITE_OWNER"🔗 References
- https://www.exploit-db.com/exploits/49679
- https://www.zeroscience.mk/en/vulnerabilities
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php
- https://www.exploit-db.com/exploits/49679
- https://www.zeroscience.mk/en/vulnerabilities
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php
