🟢CVE-2023-3438

Overview

This advisory addresses a known security vulnerability identified in a third-party dependency used within DPGW.

Vulnerability Details

  • CVE ID: CVE-2023-3438
  • Dependency Name: Trellix MOVE AntiVirus – Windows install service (mvagtsce.exe)
  • Affected Version of Dependency: <=4.10.0
  • Severity Score: NIST 7.8 High, CNA 4.4 Medium

Affected Versions of DPGW

All DPGW versions with the digi module in use (1.11.x – 1.14.x), when the digitization station is installed by the standard installation script with the default installation path C:\Program Files\DicompassDigi

Risk Assessment & Applicability

Usage
DPGW does not bundle, depend on or install Trellix MOVE AntiVirus. The vulnerable product is not part of any DPGW delivery.
The digi module of DPGW controls the Dicompass Capture program, which runs on a separate Windows digitization station. Capture is installed by the installation script install.cmd (repository dpgw/install-digi) into %DIGI_PATH% – by default C:\Program Files\DicompassDigi – and is registered as the Windows service Dicompass Capture Service by its own self-install switch "%DIGI_PATH%\%CAPTURE_VERSION%\DicompassCapture.exe" -si. The service runs under LocalSystem.

Analysis
CVE-2023-3438 is an unquoted Windows service path (CWE-428) in Trellix MOVE AntiVirus. Exploitation requires the Trellix MOVE install service mvagtsce.exe version 4.10.0 or earlier to be present on the machine. DPGW never ships this software, therefore the CVE itself is not applicable to any DPGW component.
The reason this CVE is reported against a DPGW digitization station is the same weakness class in the Dicompass Capture Service registration: the service ImagePath written by DicompassCapture.exe -si is not enclosed in quotation marks, while the default installation path C:\Program Files\DicompassDigi contains a space. Windows therefore also probes C:\Program.exe before the intended binary.
The practical exploitability of this on a digitization station is very limited:

  • planting C:\Program.exe requires the ability to create a file in the root of the system drive, which the default Windows ACL grants only to members of the Administrators group – an attacker who already holds that privilege gains nothing
  • the station is a dedicated single-purpose appliance running Windows 10; interactive logon for non-administrative accounts is not part of the standard deployment
  • the planted binary is only executed on the next start of the service, i.e. after a service restart or a reboot performed by the operator

Status
Affected

Severity Score in the context of DPGW: 2.0 Low CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/MPR:H

Impact on DPGW

If an attacker were to successfully exploit this vulnerability in the context of our software, the potential impact would be:

  • local privilege escalation to LocalSystem on the digitization station, giving full control over the captured images and videos stored on that station before they are sent to DPGW
  • no impact on the DPGW server itself, on the archive or on data of other stations

Remediation & Mitigations

Scheduled fix
The unquoted ImagePath is written by the Capture self-installation routine, so the correction belongs to Dicompass Capture. The service registration will be changed to enclose the binary path in quotation marks in an upcoming Capture release; no change to the DPGW server is required.

User Actions
Trellix MOVE AntiVirus is not part of the DPGW delivery – if it is installed on the station by the customer, update it to a version newer than 4.10.0 according to the Trellix advisory SB10404.
For the Dicompass Capture Service the exposure can be checked and mitigated without waiting for the fix:

  • resolve the service key name with sc getkeyname "Dicompass Capture Service" and inspect the registration with reg query "HKLM\SYSTEM\CurrentControlSet\Services\<key name>" /v ImagePath
  • if the value is not enclosed in quotation marks, correct it with sc config "<key name>" binPath= "\"C:\Program Files\DicompassDigi\capture\DicompassCapture.exe\""
  • verify that the root of the system drive C:\ does not allow file creation by non-administrative accounts
  • do not grant interactive or remote logon on the digitization station to non-administrative accounts