CVE-2020-7352

HIGH

GOG Galaxy GalaxyClientService Privilege Escalation

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-7352 has a selected CVSS score of 8.4 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Affected products and versions

1
ProductSourceVersion range

GOG GalaxyClientService

Browse GOG / GOG GalaxyClientService
CVE List2.0.12 to ≤ 2.0.12affected
1.2.64 to ≤ 1.2.64affected

Proofs of concept

2

Catalogued exploits

MetasploitGOG GalaxyClientService Privilege EscalationMetasploit exploitby Joe Testa <jtesta@positronsecurity.com>Not analyzed1 file

Ruby

Metasploit
PoC details

Repository PoCs

GitHubszerszen199/PS-CVE-2020-7352Repository PoCby szerszen1992Not analyzed3 files

12.1 KiB

GitHub
PoC details

References

3