GlassWire · Report #1193641
GlassWire 2.1.167 vulnerability - MSVR 56639
Validstatus
mediumseverity
3upvotes
13 Nov 2021disclosed
Summary
On May 12th Katie Lewis at Microsoft found GlassWire 2.1.167 would attempt to load Wtsapi32.dll.dll from the user's PATH (without doing any checks to see if the file is signed). GlassWire's team sent a fix that Katie Lewis confirmed solved the issue, then released an update with the fix.
How it was found
Arbitrary code execution vulnerability within the firewall software, GlassWire version 2.1.167
Impact
After the program is installed, on first execution, it will attempt to load Wtsapi32.dll.dll from the user's PATH (without doing any checks to see if the file is signed). Attached is a demo leveraging this vulnerability to spawn notepad.exe as well as screenshots showing the software searching the user’s PATH.