CVE-2023-28133
📋 TL;DR
CVE-2023-28133 allows local attackers to escalate privileges on Windows systems running Check Point Endpoint Security Client E87.30 by crafting a malicious OpenSSL configuration file. This vulnerability affects users with local access to vulnerable endpoints, enabling them to gain SYSTEM-level privileges.
💻 Affected Systems
- Check Point Endpoint Security Client
📦 What is this software?
Endpoint Security by Checkpoint
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full SYSTEM privileges, enabling complete system compromise, persistence installation, credential theft, and lateral movement capabilities.
Likely Case
Malicious insider or malware with initial user access escalates to SYSTEM to disable security controls, install backdoors, or access protected resources.
If Mitigated
With proper privilege separation and file permission controls, impact is limited to user-level compromise without privilege escalation.
🎯 Exploit Status
Exploitation requires local access and ability to write to OpenSSL configuration location. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: E87.40 and later
Vendor Advisory: https://support.checkpoint.com/results/sk/sk181276
Restart Required: Yes
Instructions:
1. Download E87.40 or later from Check Point support portal. 2. Run installer with administrative privileges. 3. Restart system when prompted.
🔧 Temporary Workarounds
Restrict OpenSSL configuration file permissions
windowsSet strict permissions on OpenSSL configuration files to prevent unauthorized modification
icacls "C:\Program Files\CheckPoint\Endpoint Security\openssl.cnf" /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" /deny "Users:(W)"
🧯 If You Can't Patch
- Implement strict file integrity monitoring on OpenSSL configuration files
- Enforce principle of least privilege and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check installed version via Control Panel > Programs > Check Point Endpoint Security Client. If version is E87.30, system is vulnerable.Check Version:
wmic product where "name like 'Check Point Endpoint Security%'" get versionVerify Fix Applied:
Verify version is E87.40 or later and test privilege escalation attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to OpenSSL configuration files
- Process creation with SYSTEM privileges from user accounts
- Failed privilege escalation attempts
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND NewProcessName LIKE '%openssl%' AND SubjectUserName NOT IN ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')