MSI Center – How to gain SYSTEM privileges in seconds

A security researcher has revealed a critical vulnerability in MSI Center, the pre-installed system management software on MSI laptops and desktops, which allows attackers to gain SYSTEM privileges within seconds. This flaw, if exploited, could enable malicious actors to execute arbitrary commands with the highest system rights, posing significant security risks. MSI responded quickly by releasing a patch, but the incident highlights vulnerabilities in OEM software commonly found on consumer devices.

The vulnerability stems from a misconfigured named pipe in MSI Center’s ‘Notebook Foundation’ service, which spawns a pipe accessible to any authenticated user. This pipe allows interaction with commands like registry modification, hardware monitoring, and executing programs as SYSTEM, the highest privilege level in Windows. The researcher demonstrated that by connecting to this pipe, malicious actors could run arbitrary commands, including launching cmd.exe or potentially malicious scripts, with SYSTEM privileges.

The researcher analyzed MSI Center’s installer, which uses Inno Setup, decompiled over 170 executables, and identified the insecure named pipe. The exploit involves registering a client, encrypting commands with outdated 3DES encryption, and leveraging the service’s brute-force decryption process to execute arbitrary code remotely via SMB, provided the attacker has valid login credentials. MSI acknowledged the flaw and released a patch within two days of disclosure, but the researcher noted that MSI’s initial response to vulnerability reports was hindered by a full email mailbox, delaying communication.

Security Risks of OEM Software in Consumer Devices

This vulnerability underscores the security risks associated with pre-installed OEM software like MSI Center, which is present on many consumer laptops and desktops. The flaw could allow attackers with network access and valid credentials to escalate privileges to SYSTEM, potentially leading to full control over affected systems. The incident raises questions about the security measures in OEM software and the importance of timely vulnerability disclosures and patches, especially given the widespread deployment of such tools.

Previous OEM Software Security Incidents and Industry Response

OEM software has historically been a target for security researchers due to its privileged access and often insufficient security measures. Previous incidents involving AMD and ASUS software revealed similar vulnerabilities, prompting calls for better security practices. MSI Center, a widely used management tool, was chosen for investigation because it is pre-installed on most MSI consumer devices, making any flaw potentially impactful across a broad user base. The researcher’s analysis involved reverse engineering, decompilation, and testing, leading to the discovery of the insecure named pipe and command execution capabilities.

“The MSI Center ‘Notebook Foundation’ service spawns a named pipe accessible to any authenticated user, allowing privilege escalation within seconds.”

— Researcher

Remaining Questions About Exploit Scope and Long-Term Security

It is still unclear how widely the vulnerability has been exploited in the wild or whether other OEM management tools share similar flaws. The researcher demonstrated local and remote code execution under specific conditions, but the full extent of potential abuse remains to be seen. Additionally, MSI has not disclosed whether additional mitigations or future updates are planned beyond the immediate patch.

Future Security Measures and OEM Software Oversight

MSI is expected to implement further security enhancements and conduct more rigorous testing of their software. Users are advised to update MSI Center promptly to mitigate the vulnerability. Industry experts suggest that OEM vendors should adopt more secure coding practices and perform comprehensive security audits on pre-installed management tools to prevent similar issues. Ongoing monitoring of exploit reports and vulnerability disclosures will determine if additional threats emerge.

Key Questions

Can this vulnerability be exploited remotely without credentials?

No, the exploit requires valid login credentials due to the named pipe only responding to authenticated users, but it can be triggered remotely via SMB if credentials are available.

Has MSI issued a fix for this vulnerability?

Yes, MSI released a patch within two days of the researcher’s report, and users should update MSI Center immediately to protect their systems.

Could this flaw be used for widespread malware attacks?

Potentially, yes. If an attacker gains access with valid credentials, they could escalate privileges and execute malicious code, including malware or ransomware.

Will MSI provide a CVE for this vulnerability?

MSI has not issued a CVE; the researcher was advised to request one via MITRE or a third-party CNA. The vulnerability is currently under review for formal CVE assignment.

Source: Hacker News