CVE-2023-7016: SafeNet Authentication Client Escalation

CVE-2023-7016 Overview

A local privilege escalation vulnerability exists in Thales SafeNet Authentication Client prior to version 10.8 R10 on Windows systems. This flaw allows an attacker with local access to execute arbitrary code with SYSTEM-level privileges, potentially leading to complete system compromise.

Critical Impact

Successful exploitation enables attackers to escalate privileges from a low-privileged user to SYSTEM, granting full control over affected Windows systems running vulnerable versions of SafeNet Authentication Client.

Affected Products

• Thales SafeNet Authentication Client versions prior to 10.8 R10
• Thales SafeNet Authentication Client 10.8 (base, R1, R5, R6, R8, R9)
• Microsoft Windows (all supported versions when running vulnerable SafeNet client)

Discovery Timeline

• 2024-02-27 - CVE-2023-7016 published to NVD
• 2025-03-04 - Last updated in NVD database

Technical Details for CVE-2023-7016

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management), indicating a fundamental flaw in how the SafeNet Authentication Client manages privilege boundaries on Windows systems. The vulnerability allows a local attacker to leverage the SafeNet client's elevated service context to execute code with SYSTEM privileges.

SafeNet Authentication Client is a middleware solution used for PKI-based authentication, smart card management, and digital signing operations. Due to its role in authentication workflows, the client typically runs with elevated privileges to interact with cryptographic tokens and perform secure operations. The improper privilege management flaw enables attackers to abuse this trust relationship.

Root Cause

The vulnerability stems from improper privilege management (CWE-269) within the SafeNet Authentication Client's Windows components. The application fails to properly validate or restrict operations that can be invoked by low-privileged users, allowing them to trigger actions that execute in the context of the SYSTEM account. This represents a breakdown in the principle of least privilege, where the software grants excessive capabilities without proper authorization checks.

Attack Vector

The attack requires local access to the target Windows system with a low-privileged user account. An attacker must be able to interact with the SafeNet Authentication Client's components—either through the application interface, exposed services, or file system interactions. Once the attacker identifies the vulnerable entry point, they can craft a malicious request or manipulate the client's behavior to execute arbitrary code with SYSTEM privileges.

The local attack vector means this vulnerability is typically exploited as part of a post-compromise escalation chain, where an attacker who has already gained initial access to a system uses this flaw to elevate their privileges for further malicious activities.

Detection Methods for CVE-2023-7016

Indicators of Compromise

• Unexpected child processes spawned by SafeNet Authentication Client services running with SYSTEM privileges
• Anomalous file modifications or creations in SafeNet installation directories by non-administrative users
• Process execution events where SACSrv.exe or related SafeNet services spawn unusual executables

Detection Strategies

• Monitor for privilege escalation attempts involving SafeNet Authentication Client processes using endpoint detection and response (EDR) solutions
• Implement application whitelisting to restrict what executables can be launched by SafeNet service components
• Configure Windows Event Log auditing to capture process creation events (Event ID 4688) with command line logging enabled

Monitoring Recommendations

• Enable process creation auditing and monitor for suspicious parent-child process relationships involving SafeNet services
• Deploy SentinelOne Singularity XDR for real-time behavioral analysis and privilege escalation detection
• Regularly review security logs for anomalous authentication client behavior and unexpected service interactions

How to Mitigate CVE-2023-7016

Immediate Actions Required

• Upgrade Thales SafeNet Authentication Client to version 10.8 R10 or later immediately
• Audit all Windows systems for installed versions of SafeNet Authentication Client
• Restrict local access to systems running vulnerable versions until patching is complete
• Implement network segmentation to limit lateral movement capabilities from potentially compromised endpoints

Patch Information

Thales has addressed this vulnerability in SafeNet Authentication Client version 10.8 R10. Organizations should obtain the patched version through the Thales Group Support Portal. Coordinate with your Thales account representative to ensure you have access to the latest security updates.

Workarounds

• Restrict local user access on systems running SafeNet Authentication Client to only authorized administrators
• Implement application control policies to prevent unauthorized code execution from SafeNet installation directories
• Monitor SafeNet service processes for anomalous behavior until the patch can be applied
• Consider temporarily disabling non-essential SafeNet client functionality on high-risk systems

# Verify installed SafeNet Authentication Client version
# Check Windows registry for version information
reg query "HKLM\SOFTWARE\SafeNet\Authentication\SAC" /v Version

# Review SafeNet service status and configuration
sc query SACSrv
sc qc SACSrv