CVE-2021-44595
📋 TL;DR
CVE-2021-44595 is a privilege escalation vulnerability in Wondershare Dr. Fone where unprivileged users can send crafted packets to ElevationService.exe to execute arbitrary code with SYSTEM privileges. This affects all users running vulnerable versions of Dr. Fone on Windows systems.
💻 Affected Systems
- Wondershare Dr. Fone
📦 What is this software?
Dr.fone by Wondershare
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining SYSTEM privileges, installing persistent malware, accessing all user data, and controlling the entire system.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install unauthorized software, or access protected system resources.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, though local attackers could still escalate privileges.
🎯 Exploit Status
Exploit requires local user access but is straightforward with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 12.0.7 (check vendor for specific fixed version)
Vendor Advisory: http://wondershare.com
Restart Required: Yes
Instructions:
1. Open Wondershare Dr. Fone. 2. Go to Help > Check for Updates. 3. Install the latest available update. 4. Restart the computer to ensure all services are updated.
🔧 Temporary Workarounds
Disable ElevationService.exe
windowsStop and disable the vulnerable service to prevent exploitation
sc stop ElevationService
sc config ElevationService start= disabled
Remove Dr. Fone
windowsUninstall the software if not required
appwiz.cpl (to open Programs and Features, then uninstall Dr. Fone)
🧯 If You Can't Patch
- Restrict local user access to systems with Dr. Fone installed
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Dr. Fone version in Help > About. If version is 12.0.7 or earlier, the system is vulnerable.Check Version:
wmic product where name="Dr. Fone" get versionVerify Fix Applied:
Verify Dr. Fone version is higher than 12.0.7 and ElevationService.exe is not running or has been updated.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from ElevationService.exe
- Network connections to ElevationService.exe from non-standard processes
Network Indicators:
- Localhost connections to ElevationService.exe port (if network enabled)
- Unusual inter-process communication patterns
SIEM Query:
Process Creation where ParentImage contains "ElevationService.exe" AND NOT Image contains expected_processes🔗 References
- http://dr.com
- http://packetstormsecurity.com/files/167036/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html
- http://wondershare.com
- https://medium.com/%40tomerp_77017/wondershell-a82372914f26
- http://dr.com
- http://packetstormsecurity.com/files/167036/Wondershare-Dr.Fone-12.0.7-Privilege-Escalation.html
- http://wondershare.com
- https://medium.com/%40tomerp_77017/wondershell-a82372914f26
