Maxthon Browser Vulnerability Can Help Attackers in Post-Exploitation Phase

Researchers have discovered a vulnerability in the Maxthon 5 Browser for Windows. Maxthon is a freeware browser developed by Maxthon Ltd, a firm headquartered in Beijing, China, and with offices in San Francisco, CA. Maxthon claims to be the default browser for 670 million worldwide users.

The vulnerability was discovered by researchers at SafeBreach Labs, and has been designated the reference CVE-2019-16647. Exploitation requires administrator privileges, but post exploitation it can be used to achieve privilege escalation, persistence and in some cases defense evasion. SafeBreach has reported the vulnerability to Maxthon, who has confirmed receipt and provided a timeline for a fix. Neither the timeline nor confirmation that the fix is effective have been published.

The vulnerability occurs because part of the Maxthon software — including MxService.exe — runs as ‘NT AUTHORITYSYSTEM’, giving it powerful permissions and capabilities. It is signed by Maxthon Technology Co, Ltd, so any malicious payload executed by MxService gets an application whitelisting bypass. And it starts automatically on system boot, providing a persistence mechanism.

The problem occurs because services.exe looks for a file it cannot find (program.exe). By simply dropping their own ‘program.exe’ as a PoC, the researchers demonstrated that their unsigned payload still ran as NT AUTHORITYSYSTEM, providing scope for further privilege escalation.

The basic cause of the problem lies in the Maxthon browser installation phase. sprintf is called to format the buffer containing the path of the service executable. However, the path is not a quoted string. The final path includes ‘Program Files’ (containing a space). The CreateServiceW function doesn’t know whether it’s part of the path or whether it’s an argument, and tries to parse the first word. “Program Files” is firstly ‘Program’ (which it doesn’t find), and then ‘Program.exe’ (which it either doesn’t find or finds a potentially malicious insertion instead).

It is a simple coding error that should be easily fixable. The solution is specified in the CreateServiceW function documentation in MSDN: “If the path contains a space, it must be quoted so that it is correctly interpreted.” Because of the space between ‘Program’ and ‘Files’ in the specified path, the entire path should have been, but was not, contained in double quotes.

Without being fixed, however, a malicious payload gains persistence by being loaded every time the browser is restarted. “This way,” warn the researchers, “the malicious payload might not be detected by security products, because the service process which executes the attacker’s payload is signed, and executes it ‘natively’. No suspicious action is required by the attacker. The serviceit just executes the malicious executable once it is started.”

While this should be a simple fix, we do not at this time have confirmation on whether it has or when it will be fixed by Maxthon. The latest official version is 5.2.7, released prior to Safebreach’s notification to Maxthon, and included by SafeBreach as among the affected versions (5.1.0 to 5.2.7). The latest beta version of Maxthon (5.3.8.1600) was released after SafeBreach’s notification — but the key changes release note contains no mention of a relevant fix.

Maxthon is no stranger to controversy. In 2016, researchers at Fidelis and Exatel found that the browser was regularly sending data that included information on the operating system, CPU, ad blocker status, homepage URL, websites visited by the user (including online searches), and installed applications and their version number to Maxthon’s server. Although encrypted, it could easily be decrypted — leaving the data vulnerable to man-in-the-middle attacks. This was in the early stages of the growing concern about Chinese companies having access to non-Chinese personal data.

This data was being collected even if the user opted out of the so-called User Experience Improvement Program under which it was collected.

Related: Browser Extensions Massively Collecting User Data 

Related: Mac Malware Steals Browser Cookies, Sensitive Data

Related: Archive Server of Pale Moon Open Source Browser Hacked 

Related: U.S. Blocks China Mobile, Citing National Security