Trustwave SpiderLabs Security Advisory TWSL2021-019:
Privilege Escalation in CrypKey License Software Licensing System 

Published: 11/04/2021
Version: 1.0

Vendor:  CrypKey (www.crypkey.com)
Product: CrypKey Software Licensing System
Versions affected: 7.7.0.0 on Windows

Product description:
CrypKey Software Licensing System.

Finding 1: Privilege Escalation
Credit: Martin Rakhmanov of Trustwave

The CrypKey License Windows service allows malicious authenticated users 
run code as NT AUTHORITY\SYSTEM via creation of several files.

Unprivileged Windows users can create the following file:

C:\ProgramData\CrypKey\CKCS.INI

Note that first the C:\ProgramData\CrypKey directory must be created. This 
is possible with default Windows permissions set on the C:\ProgramData

CKCS.INI file content should be:

[..\\TEMP\\M.]

Next, another file should be created:

C:\Windows\Temp\M.ces.ini

Content:

[GENERAL]
STATUS=Enabled

Finally, a file called CKConfig.DLL must be copied under the C:\Windows\Temp\ 
and that file should be a valid Windows 32-bit DLL containing arbitrary code 
to execute as NT AUTHORITY\SYSTEM.

On next CrypKey License restart (e.g. once the computer is rebooted - TEMP 
directory content is preserved) the code from the malicious DLL will be 
executed.

Remediation Steps:
No official fix is available. To limit exposure, restrict local access to trusted
users only.  Additionally, network access to these devices should be limited to
authorized personnel through the use of Access Control Lists and proper network
segmentation.


Revision History:
06/11/2021 - Initial email to vendor
06/17/2021 - 2nd attempt to contact vendor
06/17/2021 - Vendor replies "Not interested" 
06/17/2021 - Responded to vendor with details and severity
08/02/2021 - New attempt to persuade vendor to investigate
11/01/2021 - Final outreach attempt
11/04/2021 - Advisory published


About Trustwave:
Trustwave is the leading provider of on-demand and subscription-based
information security and payment card industry compliance management
solutions to businesses and government entities throughout the world. For
organizations faced with today's challenging data security and compliance
environment, Trustwave provides a unique approach with comprehensive
solutions that include its flagship TrustKeeper compliance management
software and other proprietary security solutions. Trustwave has helped
thousands of organizations--ranging from Fortune 500 businesses and large
financial institutions to small and medium-sized retailers--manage
compliance and secure their network infrastructure, data communications and
critical information assets. Trustwave is headquartered in Chicago with
offices throughout North America, South America, Europe, Africa, China and
Australia. For more information, visit https://www.trustwave.com

About Trustwave SpiderLabs:
SpiderLabs(R) is the advanced security team at Trustwave focused on
application security, incident response, penetration testing, physical
security and security research. The team has performed over a thousand
incident investigations, thousands of penetration tests and hundreds of
application security tests globally. In addition, the SpiderLabs Research
team provides intelligence through bleeding-edge research and proof of
concept tool development to enhance Trustwave's products and services.
https://www.trustwave.com/spiderlabs

Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.