CVE-2023-34407
📋 TL;DR
CVE-2023-34407 is a directory traversal vulnerability in Harbinger Offline Player's OfflinePlayerService.exe that allows attackers to access arbitrary files on the system by using '..\' sequences in URLs. This affects systems running Harbinger Offline Player 4.0.6.0.2, potentially exposing sensitive data or enabling further system compromise.
💻 Affected Systems
- Harbinger Offline Player
📦 What is this software?
Office Player by Harbingergroup
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via LocalSystem privilege escalation leading to complete control of the affected system, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized file access and potential credential theft from system files, configuration files, or application data.
If Mitigated
Limited impact with proper network segmentation and file system permissions preventing access to critical system files.
🎯 Exploit Status
Public proof-of-concept demonstrates directory traversal via URL manipulation. Exploitation is straightforward with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider workarounds.
🔧 Temporary Workarounds
Network Access Restriction
windowsBlock network access to OfflinePlayerService.exe using firewall rules
netsh advfirewall firewall add rule name="Block OfflinePlayerService" dir=in action=block program="C:\Path\To\OfflinePlayerService.exe" enable=yes
Service Disablement
windowsDisable the OfflinePlayerService if not required
sc config OfflinePlayerService start= disabled
sc stop OfflinePlayerService
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Apply principle of least privilege to file system permissions and monitor for unusual file access patterns
🔍 How to Verify
Check if Vulnerable:
Check if OfflinePlayerService.exe version 4.0.6.0.2 is running and accessible on the networkCheck Version:
wmic datafile where name="C:\\Path\\To\\OfflinePlayerService.exe" get versionVerify Fix Applied:
Verify service is no longer accessible or has been updated to a patched version📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from OfflinePlayerService.exe
- URL requests containing '..\' sequences
Network Indicators:
- Traffic to OfflinePlayerService.exe on unusual ports
- Multiple sequential file access requests
SIEM Query:
source="OfflinePlayerService.exe" AND (url="*..\\*" OR file_access="*..\\*")