CVE-2021-37364
📋 TL;DR
OpenClinic GA 5.194.18 has insecure file permissions that allow authenticated low-privilege users to replace critical service executables with malicious files. When the system restarts, these malicious files execute with SYSTEM privileges, granting attackers full system control. This affects all installations using default permissions.
💻 Affected Systems
- OpenClinic GA
📦 What is this software?
Openclinic Ga by Openclinic Ga Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, allowing complete control over the server, data theft, and lateral movement within the network.
Likely Case
Privilege escalation from low-privilege authenticated user to SYSTEM, enabling persistence, data manipulation, and further attacks.
If Mitigated
Limited to low-privilege user capabilities with no ability to escalate privileges or execute arbitrary code.
🎯 Exploit Status
Exploit requires authenticated access and system restart to trigger. Unquoted service path issues may provide additional attack vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Apply workarounds and consider alternative software if possible.
🔧 Temporary Workarounds
Restrict File Permissions
windowsRemove modify permissions for Authenticated Users group on OpenClinic installation folders, particularly bin directories containing mysqld.exe and tomcat8.exe.
icacls "C:\Program Files\OpenClinic\bin" /remove:g "Authenticated Users" /T
icacls "C:\Program Files\OpenClinic\bin" /deny "Authenticated Users":(M)
Fix Unquoted Service Paths
windowsEnsure all service paths in Windows Services are properly quoted to prevent path interception attacks.
sc config "OpenClinic Service Name" binPath= "\"C:\Program Files\OpenClinic\bin\service.exe\""
🧯 If You Can't Patch
- Implement strict access controls and monitor for unauthorized file modifications in OpenClinic directories.
- Segment network to isolate OpenClinic servers and implement application allowlisting to prevent execution of unauthorized binaries.
🔍 How to Verify
Check if Vulnerable:
Check file permissions on OpenClinic bin directories: icacls "C:\Program Files\OpenClinic\bin\mysqld.exe" and icacls "C:\Program Files\OpenClinic\bin\tomcat8.exe" - look for Authenticated Users having Modify or Full Control permissions.Check Version:
Check OpenClinic version in application interface or installation directory properties.Verify Fix Applied:
Verify Authenticated Users group no longer has modify permissions on critical executables and service paths are properly quoted in Windows Services.📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system modification) for OpenClinic bin directories
- Unexpected service restarts or process creations from OpenClinic directories
Network Indicators:
- Outbound connections from OpenClinic server to unknown external IPs following system restart
SIEM Query:
EventID=4663 AND ObjectName LIKE '%OpenClinic%bin%' AND Accesses LIKE '%WRITE_DAC%' OR Accesses LIKE '%WRITE_OWNER%' OR Accesses LIKE '%DELETE%'🔗 References
- https://sourceforge.net/projects/open-clinic/
- https://sourceforge.net/projects/open-clinic/files/latest/download
- https://www.exploit-db.com/exploits/50448
- https://sourceforge.net/projects/open-clinic/
- https://sourceforge.net/projects/open-clinic/files/latest/download
- https://www.exploit-db.com/exploits/50448
