CVE-2023-7016 - Thales SafeNet Authentication Client Vulnerability Allows Attackers to Execute System-Level Code via Local Access if Prior to 10.8 R10 on Windows

A recently identified vulnerability, titled CVE-2023-7016, has been discovered in Thales SafeNet Authentication Client versions prior to 10.8 R10 on Windows. This vulnerability has the potential to allow an attacker to execute code at a SYSTEM level via local access, posing a severe security risk for affected users. This post aims to provide an overview of the vulnerability, including its technical details, exploit considerations, and necessary mitigation steps. Additionally, links to original references and resources are provided to assist users in understanding and addressing this critical security issue.

Background

Thales SafeNet Authentication Client is a middleware that manages Thales's eToken and iKey certificate-based tokens. The software is often utilized for secure remote access, password management, and other security applications. This makes it crucial to ensure the software and its associated infrastructure remains secure.

Vulnerability Details

The CVE-2023-7016 vulnerability is a result of a flaw in the Thales SafeNet Authentication Client. Specifically, an issue exists when handling the loading of Dynamic Link Libraries (DLLs). In certain cases, an attacker who has local access to a vulnerable system can exploit this vulnerability to load a malicious DLL and execute arbitrary code with elevated privileges - specifically at the SYSTEM level.

Exploit Considerations

To exploit the CVE-2023-7016 vulnerability, an attacker must first have local access to a vulnerable system. This can occur through various means, such as compromising a user's account or utilizing malicious software to gain unauthorized access. Once local access is achieved, the attacker can use specially crafted DLL payloads to exploit the vulnerability and execute arbitrary code.

It is important to note that this exploit requires local access and may not be feasible in all scenarios or situations. However, in instances where local access is achieved, the potential for significant security breaches and system compromise is high.

Mitigation Steps

To properly address and mitigate the risk associated with CVE-2023-7016, users of Thales SafeNet Authentication Client should take the following steps:

1. Immediately update to the latest version of the software (10.8 R10 or later). The updated version contains a patch that resolves the vulnerability. It can be downloaded from Thales's website at the following link: Thales SafeNet Authentication Client Latest Version

2. Ensure that all systems utilizing Thales SafeNet Authentication Client are properly maintained and receive regular security updates and patches.

3. Always practice good security hygiene, including implementing strong account and password management policies, to reduce the risk of unauthorized local access to critical systems.

Conclusion

CVE-2023-7016 is a critical vulnerability in Thales SafeNet Authentication Client that, if left unaddressed, has the potential to put sensitive information and systems at risk. By understanding the technical details and potential exploits associated with this vulnerability, users can make informed decisions about addressing and mitigating their risk. By following the mitigation steps outlined above and regularly updating software and security measures, users can help protect their systems from potential compromises.

For additional information and updates on this vulnerability, users are encouraged to refer to the following references:

- National Vulnerability Database - CVE-2023-7016
- Thales Security Advisory - SafeNet Authentication Client

Timeline

Published on: 02/27/2024 11:15:07 UTC
Last modified on: 02/27/2024 14:19:41 UTC