CVE-2024-7479: TeamViewer Privilege Escalation Vulnerability

CVE-2024-7479 Overview

CVE-2024-7479 is a privilege escalation vulnerability affecting TeamViewer Remote Clients for Windows prior to version 15.58.4. The vulnerability stems from improper verification of cryptographic signatures during the installation of a VPN driver via the TeamViewer_service.exe component. This flaw allows an attacker with local unprivileged access on a Windows system to elevate their privileges and install arbitrary drivers.

Critical Impact

Local attackers can exploit this vulnerability to bypass cryptographic signature verification and install malicious drivers, achieving full system-level privileges on affected Windows systems running TeamViewer.

Affected Products

• TeamViewer Remote Clients for Windows versions prior to 15.58.4
• Systems with TeamViewer VPN driver installation functionality enabled
• Windows environments where unprivileged users have local access

Discovery Timeline

• 2024-09-25 - CVE-2024-7479 published to NVD
• 2024-09-26 - Last updated in NVD database

Technical Details for CVE-2024-7479

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), which indicates a fundamental weakness in how the TeamViewer service validates the authenticity of drivers before installation. The TeamViewer_service.exe component runs with elevated system privileges and is responsible for installing VPN drivers when requested. However, the cryptographic signature verification process contains a flaw that allows attackers to bypass these security checks.

The attack requires local access to the target system but does not require any user interaction once the attacker has established a foothold. The vulnerability has a scope change impact, meaning successful exploitation can affect resources beyond the vulnerable component itself, potentially compromising the entire Windows system.

Root Cause

The root cause lies in improper validation of cryptographic signatures within the VPN driver installation routine of TeamViewer_service.exe. The TeamViewer service fails to adequately verify that drivers being installed are legitimately signed and authorized. This cryptographic validation weakness allows an attacker to inject unsigned or maliciously signed drivers into the installation process.

The vulnerability exists because the signature verification logic does not properly enforce certificate chain validation, signature integrity checks, or both. This allows an unprivileged local user to leverage the elevated TeamViewer service to install drivers that would normally require administrative privileges.

Attack Vector

The attack is executed locally on a Windows system where TeamViewer is installed. An attacker with unprivileged local access can interact with the TeamViewer_service.exe component and exploit the signature verification bypass during VPN driver installation. The attack flow involves:

1. The attacker gains local access to a Windows system running a vulnerable TeamViewer version
2. The attacker prepares a malicious driver payload disguised as a legitimate VPN driver
3. The attacker triggers the VPN driver installation process via the TeamViewer service
4. Due to improper signature verification, the malicious driver is installed with system-level privileges
5. The attacker achieves privilege escalation and can execute arbitrary code with kernel-level access

The vulnerability does not require exploitation code examples from verified sources. For technical implementation details, refer to the TeamViewer Security Bulletin TV-2024-1006.

Detection Methods for CVE-2024-7479

Indicators of Compromise

• Unexpected driver installations on systems running TeamViewer, particularly involving unsigned or unusually signed drivers
• Suspicious activity involving TeamViewer_service.exe attempting to install VPN-related drivers
• New kernel-mode drivers appearing in the system that do not correspond to legitimate TeamViewer updates
• Anomalous privilege escalation events correlated with TeamViewer service activity

Detection Strategies

• Monitor Windows Event Logs for driver installation events (Event ID 7045 for new service installations)
• Implement application whitelisting to detect unauthorized driver installations
• Use endpoint detection and response (EDR) solutions to monitor TeamViewer_service.exe behavior and child processes
• Track cryptographic signature validation failures in system security logs

Monitoring Recommendations

• Configure alerts for any driver installations initiated by TeamViewer service components
• Establish baseline behavior for TeamViewer processes and alert on deviations
• Monitor for lateral movement attempts following potential privilege escalation
• Implement file integrity monitoring on critical system driver directories

How to Mitigate CVE-2024-7479

Immediate Actions Required

• Upgrade TeamViewer Remote Clients for Windows to version 15.58.4 or later immediately
• Audit systems for signs of exploitation, particularly unauthorized driver installations
• Review and restrict local access permissions on systems running TeamViewer
• Implement the principle of least privilege for users who require TeamViewer access

Patch Information

TeamViewer has addressed this vulnerability in version 15.58.4 of the Remote Client for Windows. Organizations should prioritize updating all affected installations. The security bulletin is available at the TeamViewer Trust Center. Verify the update by checking the TeamViewer version through Help > About TeamViewer after installation.

Workarounds

• Restrict local user access on systems running TeamViewer to trusted administrators only
• Disable VPN driver functionality if not required for business operations
• Implement application control policies that prevent unauthorized driver installations
• Use network segmentation to isolate systems running vulnerable TeamViewer versions until patching is complete

# Verify TeamViewer version on Windows systems
# Run in PowerShell to check installed version
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\TeamViewer" | Select-Object Version

# Alternative: Check via file properties
(Get-Item "C:\Program Files\TeamViewer\TeamViewer.exe").VersionInfo.FileVersion