Webroot Multiple Vulnerabilities

Webroot endpoint agents under version v9.0.28.48 are vulnerable to the following issues.

 
CVE-2020-5754 - Type Confusion 

This Type Confusion vulnerability is in wrUrl.dll which can result in locally or remotely crashing the Webroot service as well as remotely reading contents of memory in the Webroot service. When wrUrl.dll is listening for incoming JSON data, an attacker can call "OP" 1, which will result in wrUrl.dll traversing the "DATA" list from the attacker's supplied JSON object. The problem is that the elements in the DATA list are not type checked, and instead assumed to be JSON objects themselves. If an attacker passes a LIST object in this "DATA" list, wrUrl will attempt to key the "URL" value on a list object. By providing a DATA element of ["URL"], the keying operation of "URL" will succeed, however will mistakenly return the next list element's contents. The next element can be another list which contains a string of an encoded pointer, which will later be dereferenced and its pointer contents will be echoed back to the client in the "URL" ouput parameter. Below is an example of this via Curl and how it reads the contents of a dll loaded in memory. 

Example:

curl -X POST --header "Content-Type:application/urltree; charset=utf-8" -d "{\"VER\":1, \"OP\":1, \"DATA\":[[\"URL\"], [\"\\u004c\\u0000\\u0064\\u007311111111111111111\"]], \"BRWSR\":\"Chrome\"}" 10.0.2.5:27019

Response (contents of a dll in memory is returned back over the network):

{"VER":1,"OP":1,"ERR":0,"DATA":[{"URL":"�!This program cannot be run in DOS mode.\r\r\n$","CAT.CONF":["0.0"],"BCRI":40,"ALCAT":0,"RTAP":0,"BLK":0,"REF":0}]} 

CVE-2020-5755 - Local Privilege Escalation

This is due to the %PROGRAMDATA%\WrData\ folder (which contains .dlls that are loaded by the WebRoot service) not being protected against writes. In this scenario, an attacker could trigger the type-confusion bug to crash the service locally, then rename the %PROGRAMDATA%\WrData\PKG to %PROGRAMDATA%\WrData\PKG2, craft their own %PROGRAMDATA%\WrData\PKG directory, and supply their own WrUrl.dll or wrPhreshPhish.dll to hijack the dll when service auto-restarts resulting in privilege escalation to SYSTEM.