CVE-2024-42053
📋 TL;DR
This vulnerability allows local users on Windows systems to escalate privileges to SYSTEM by exploiting weak permissions in a temporary folder used during Splashtop Streamer installation. Attackers can place a malicious version.dll file to gain full system control. Only affects Windows systems running vulnerable versions of Splashtop Streamer.
💻 Affected Systems
- Splashtop Streamer for Windows
📦 What is this software?
Streamer by Splashtop
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM privileges, enabling complete system compromise, installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local user or malware with initial access escalates to SYSTEM to bypass security controls, install additional payloads, or maintain persistence.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained before significant damage occurs.
🎯 Exploit Status
Exploit requires local access to the system. The technique involves DLL hijacking in a weakly-permissioned temporary folder.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.0.0
Vendor Advisory: https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released
Restart Required: Yes
Instructions:
1. Download Splashtop Streamer version 3.6.0.0 or later from official sources. 2. Run the installer with administrative privileges. 3. Restart the system after installation completes.
🔧 Temporary Workarounds
Restrict temporary folder permissions
windowsManually secure the temporary installation folder to prevent unauthorized file creation
icacls "C:\ProgramData\SplashtopStreamerTemp" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W)"
🧯 If You Can't Patch
- Implement strict least privilege access controls to limit local user permissions
- Monitor for suspicious DLL creation in temporary folders and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Splashtop Streamer version in Control Panel > Programs and Features. If version is below 3.6.0.0, system is vulnerable.Check Version:
wmic product where "name like 'Splashtop%Streamer%'" get versionVerify Fix Applied:
Verify version is 3.6.0.0 or higher in Control Panel > Programs and Features. Check that temporary installation folder has proper permissions.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual locations
- Security logs showing privilege escalation attempts
- Process creation events for unexpected SYSTEM-level processes
Network Indicators:
- Unusual outbound connections from SYSTEM processes
- Lateral movement attempts from previously low-privilege systems
SIEM Query:
source="windows_security" EventID=4688 NewProcessName="*version.dll" OR ParentProcessName="*Splashtop*"🔗 References
- https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md
- https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released
- https://github.com/SpacePlant/Vulns/blob/main/Advisories/2024/2.md
- https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/18223802896539-Splashtop-Streamer-version-v3-6-0-0-for-Windows-released
