Exploit-DB #47019
Description: EA Origin < 10.5.38 - Remote Code Execution
Type: remote
Platform: windows
Date: 2019-06-21
Author: Dominik Penner

Exploit:
# Exploit Title: EA Origin <10.5.38 Remote Code Execution
# Date: 05/22/2019
# Exploit Author: Dominik Penner (@zer0pwn)
# Vendor Homepage: https://www.origin.com
# Software Link: https://www.origin.com/can/en-us/store/download
# Version: 10.5.38 and below
# Tested on: Windows 7, Windows 8, Windows 10
# CVE : CVE-2019-12828

Electronic Arts' Origin Client on Windows in versions 10.5.38 and below is vulnerable to an argument injection vulnerability, that if leveraged properly, can ultimately yield remote code execution.

NOTE: THIS IS TO BE READ IN MARKDOWN (.MD) FORMAT

# 0x01 Introduction

Over the past month or so, I've spent quite a bit of time reading and experimenting with custom URI schemes. As the last post on this blog clearly demonstrated, a poorly implemented custom URI can have a number of security concerns. When I say "a number", it's because I'm about to bring a few more to light, using EA's Origin Client as our crash test dummy.

TL;DR: Another Origin RCE, unrelated to CVE-2019-11354.

# 0x02 Custom URI Schemes

In this demonstration, we're going to be using the Origin client. However, this vulnerability can be found in a number of other applications. This technique is hardly Origin specific. In order for us to fully understand how this exploit works, we need to understand how Windows treats custom URI schemes.

If we look for Origin's URI scheme in the registry, this is what we find.

[![](https://zeropwn.github.io/assets/origin_regedit.png "Origin Regedit")](https://zeropwn.github.io/assets/origin_regedit.png)

As we can see by this snippet, 

```
"C:\Program Files (x86)\Origin\Origin.exe" "%1"
```

whenever we call ```origin://``` or ```origin2://```, Windows will use ```ShellExecute()``` to spawn the process and replace %1 with our input.

For example:

```
origin://game/launch
```

Spawns the Origin process with the following command line arguments:

```
C:\Program Files (x86)\Origin\Origin.exe "origin://game/launch"
```

If we RTFM a little bit and check out MSDN's documentation on registering custom URI schemes, we'll see that they point out some security issues. This is what they have to say:

"As noted above, the string that is passed to a pluggable protocol handler might be broken across multiple parameters. Malicious parties could use additional quote or backslash characters to pass additional command line parameters. For this reason, pluggable protocol handlers should assume that any parameters on the command line could come from malicious parties, and carefully validate them. Applications that could initiate dangerous actions based on external data must first confirm those actions with the user. In addition, handling applications should be tested with URIs that are overly long or contain unexpected (or undesirable) character sequences."

This basically means that the application should be responsible for making sure that there aren't any illegal characters or arguments injected via the crafted URI.

## A long history of URI-based exploits
As detailed in this blog post... argument injection via URI isn't new... at all. [https://medium.com/0xcc/electrons-bug-shellexecute-to-blame-cacb433d0d62](https://medium.com/0xcc/electrons-bug-shellexecute-to-blame-cacb433d0d62)

Some of these vulnerabilities can escape the "%1" argument by adding an unencoded " to the URI. For example, to inject arguments with CVE-2007-3670, all you had to do was get a remote user to visit your specially crafted iframe + URI, and the process would be spawned with the additional arguments injected.

```
firefoxurl://placeholder" --argument-injection
```

### Couldn't you just use command injection?

Because of the way ShellExecute gets called and passes the arguments, you cannot ultimately inject your own commands, only arguments.


# 0x03 Argument Injection

Due to the way that most applications (browsers, mail clients, etc) handle URIs, this becomes difficult to exploit in 2019. Modern browsers (Chrome, Firefox, Edge) will force encode certain characters when a link is handled. This obviously makes escaping the encapsulation difficult.

However, for custom URIs that don't have encapsulated arguments in the registry, you can easily just inject arguments with a space.

mIRC was recently vulnerable to this, to achieve RCE, the payload ending up being as simple as:

```
<iframe src='irc://? -i\\127.0.0.1\C$\mirc-poc\mirc.ini'>
```

You can read more about how that exploit was discovered and exploited here:
[https://proofofcalc.com/cve-2019-6453-mIRC/](https://proofofcalc.com/cve-2019-6453-mIRC/)


Anyways, for this example with Origin, we're just going to spin up a fresh Windows 8 box and use IE11. We'll talk more about bypassing modern security mechanisms later.

## The Payload

So now that we've spun up our virtual machine, make sure you have Origin installed. Open a notepad, and paste the following:

```
<iframe src='origin://?" -reverse "'>
```

Open it in Internet Explorer, and allow Origin to launch (if it even prompts, lol). You should see the following.

[![](https://zeropwn.github.io/assets/origin_reverse.png "Origin Arginj")](https://zeropwn.github.io/assets/origin_reverse.png)

As you can see in the image above, the window icons are now loading in reverse. I failed to mention this, however "-reverse" is a Qt specific argument. Origin is written mainly using the Qt framework, which is what enticed me into trying these arguments.

If we take a look at the process using Process Explorer, we see the following:

[![](https://zeropwn.github.io/assets/origin_reverse_poc.png "Origin Arginj")](https://zeropwn.github.io/assets/origin_reverse_poc.png)

This clearly demonstrates the argument injection.

# 0x04 Arbitrary Code Execution

Now how on earth are we supposed to get code execution from this? For us to see what options we have available, we need to know what other arguments we can u