CVE-2023-50159
📋 TL;DR
This vulnerability allows attackers to bypass kiosk mode application restrictions in ScaleFusion Windows Desktop App, enabling execution of arbitrary code. It affects organizations using ScaleFusion's kiosk mode for controlled device access. The bypass occurs through launching file explorer in restricted modes.
💻 Affected Systems
- ScaleFusion Windows Desktop App
📦 What is this software?
Scalefusion by Scalefusion
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of malware, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized access to restricted systems, potential data theft, and installation of unauthorized applications.
If Mitigated
Limited impact with proper network segmentation and monitoring, though kiosk functionality would still be bypassed.
🎯 Exploit Status
Exploitation requires physical or remote access to the kiosk device. Multiple public disclosures detail the bypass technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.5.7
Vendor Advisory: https://help.scalefusion.com/docs/security-advisory-for-windows-mdm-agent
Restart Required: Yes
Instructions:
1. Download ScaleFusion agent version 10.5.7 or later from vendor portal. 2. Deploy to all affected Windows devices. 3. Restart devices to apply changes. 4. Verify kiosk mode restrictions are properly enforced.
🔧 Temporary Workarounds
Disable File Explorer Access
windowsUse Group Policy or local policies to restrict file explorer access in kiosk mode
gpedit.msc -> User Configuration -> Administrative Templates -> Windows Components -> File Explorer -> Prevent access to drives from My Computer
Enhanced Monitoring
allImplement additional monitoring for file explorer processes in kiosk environments
🧯 If You Can't Patch
- Isolate kiosk devices on separate network segments with strict firewall rules
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check ScaleFusion agent version: If version is 10.5.2 or earlier, device is vulnerable. Attempt to launch file explorer while in kiosk mode.Check Version:
Check ScaleFusion agent version in Windows Settings > Apps or via command line: wmic product where name='ScaleFusion' get versionVerify Fix Applied:
After patching to 10.5.7+, verify file explorer cannot be launched in Agent-based Multi-App or Single App Kiosk mode.📡 Detection & Monitoring
Log Indicators:
- File explorer process (explorer.exe) launched during kiosk sessions
- Unauthorized application execution events in Windows Event Logs
Network Indicators:
- Unexpected outbound connections from kiosk devices
- Downloads from unauthorized sources
SIEM Query:
EventID=4688 AND ProcessName='explorer.exe' AND User LIKE '%kiosk%' OR CommandLine CONTAINS 'explorer.exe'🔗 References
- https://help.scalefusion.com/docs/security-advisory-for-windows-mdm-agent
- https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6
- https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59
- https://help.scalefusion.com/docs/security-advisory-for-windows-mdm-agent
- https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6
- https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59
