The Dells SupportAssist software is currently associated with a vulnerability allowing Remote Code Execution (RCE) attacks. It comes pre-installed on virtually all new Dell devices running Windows®, the SupportAssist application “proactively checks the health of your system’s hardware and software. When an issue is detected, the necessary system state information is sent to Dell for troubleshooting to begin.”
Dell released an advisory, DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities, where it announced “An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.” The vulnerability is being tracked as CVE-2019-3719 and comes with a Base Severity score 8.0 HIGH in NIST’s CVE database. MITRE has performed an analysis on the vulnerability and has also added that description to the CVE stating, “Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables.”
Primarily Dell uses the SupportAssist application to be able to install drivers and other software remotely, but to accomplish this, it must be able to detect what is already present on your system. Installing the SupportAssist package installs two packages, the SupportAssistAgent, and the Dell Hardware Support service. The services essentially expose a REST API of sorts which supports the communication between the service and Dell’s websites.
Security researcher Bill Demirkapi who discovered the vulnerability states in his blog “On start, Dell SupportAssist starts a web server (System.Net.HttpListener) on either port 8884, 8883, 8886, or port 8885. The port depends on whichever one is available, starting with 8884. On a request, the ListenerCallback located in HttpListenerServiceFacade calls ClientServiceHandler.ProcessRequest.
ClientServiceHandler.ProcessRequest, the base web server function, starts by doing integrity checks for example making sure the request came from the local machine and various other checks. Later in this article, we’ll get into some of the issues in the integrity checks, but for now most are not important to achieve RCE.”
It should also be noted that Demirkapi discovered the vulnerability in September of 2018 and promptly sent a write up to Dell explaining the RCE vulnerability. Dell confirmed the vulnerability on 11/22/2018 and finally released a patch and advisory on 4/18/2019.
Sources:
• https://nvd.nist.gov/vuln/detail/CVE20193719#vulnCurrentDescriptionTitle
• https://d4stiny.github.io/RemoteCode-Execution-on-most-Dellcomputers