Razer bug lets you come to be a Home windows 10 admin by plugging in a mouse

A Razer Synapse zero-working day vulnerability has been disclosed on Twitter, letting you to achieve Home windows admin privileges only by plugging in a Razer mouse or keyboard.

Razer is a quite well-liked laptop or computer peripherals manufacturer known for its gaming mouses and keyboards.

When plugging in a Razer system into Home windows 10 or Windows 11, the running process will quickly obtain and start installing the Razer Synapse application on the laptop. Razer Synapse is software package that allows people to configure their hardware devices, established up macros, or map buttons.

Razer promises that that their Razer Synapse software package is employed by over 100 million users around the globe.

Stability researcher jonhat discovered a zero-day vulnerability in the plug-and-perform Razer Synapse installation that will allow consumers to acquire Method privileges on a Home windows product quickly.

Method privileges are the maximum consumer rights readily available in Windows and make it possible for a person to execute any command on the running method. In essence, if a consumer gains Program privileges in Home windows, they achieve complete regulate in excess of the procedure and can put in no matter what they want, together with malware.

Right after not obtaining a response from Razer, jonhat disclosed the zero-day vulnerability on Twitter yesterday and described how the bug is effective with a shorter video.

Need community admin and have physical accessibility?
– Plug a Razer mouse (or the dongle)
– Home windows Update will obtain and execute RazerInstaller as Technique
– Abuse elevated Explorer to open Powershell with Change+Ideal simply click

Tried calling @Razer, but no answers. So here is a freebie pic.twitter.com/xDkl87RCmz

— jonhat (@j0nh4t) August 21, 2021

Finding Process privileges by plugging in a mouse

As BleepingComputer has a Razer mouse accessible, we made a decision to take a look at out the vulnerability and have confirmed that it took us about two minutes to get Method privileges in Home windows 10 soon after plugging in our mouse.

It should really be observed that this is a nearby privilege escalation (LPE) vulnerability, which suggests that you need to have a Razer devices and physical access to a computer system. With that reported, the bug is so simple to exploit as you just will need to commit $20 on Amazon for Razer mouse and plug it into Home windows 10 to grow to be an admin.

To exam this bug, we made a temporary ‘Test’ consumer on 1 of our Home windows 10 pcs with conventional, non-administrator privileges, as proven underneath.

When we plugged the Razer unit into Windows 10, the functioning technique instantly downloaded and installed the driver and the Razer Synapse application.

Due to the fact the RazerInstaller.exe executable was released via a Windows approach functioning with System privileges, the Razer installation system also obtained Technique privileges, as shown below.

When the Razer Synapse application is mounted, the set up wizard allows you to specify the folder wherever you would like to put in it. The capability to pick out your installation folder is where everything goes completely wrong.

When you modify the location of your folder, a ‘Choose a Folder’ dialog will show up. If you press Shift and appropriate-simply click on the dialog, you will be prompted to open up ‘Open PowerShell window listed here,’ which will open up a PowerShell prompt in the folder revealed in the dialog.

As this PowerShell prompt is becoming released by a course of action with Process privileges, the PowerShell prompt will also inherit those exact same privileges.

As you can see under, when we opened the PowerShell prompt and typed the ‘whoami’ command, it confirmed that the console has Technique privileges letting us to difficulty any command we want.

As spelled out by Will Dormann, a Vulnerability Analyst at the CERT/CC, related bugs are very likely to be found in other software mounted by the Home windows plug-and-engage in process.

Several vulnerabilities fall into the course of “How has no person recognized this prior to now?”

If you incorporate the facts of “connecting USB routinely masses software” and “computer software installation happens with privileges”, I am going to wager that there are other exploitable packages out there…

— Will Dormann (@wdormann) August 22, 2021

A online video demonstration of the Razer Synapse vulnerability has also been shared by jonhat, which can be viewed down below.

Razer to resolve the vulnerability

After this zero-working day vulnerability acquired broad interest on Twitter, Razer has contacted the security researcher to allow them know that they will be issuing a repair.

I would like to update that I have been reached out by @Razer and ensured that their protection crew is functioning on a repair ASAP.

Their method of conversation has been experienced and I have even been presented a bounty even nevertheless publicly disclosing this difficulty.

— jonhat (@j0nh4t) August 22, 2021

Razer also instructed the researcher that he would be receiving a bug bounty reward even although the vulnerability was publicly disclosed.