LPE zero-day flaw in Razer Synapse allows attackers to take over Windows PCs

A zero-day vulnerability in Razer Synapse could allow threat actors to gain Windows admin privileges by plugging in a Razer mouse or keyboard.

Razer is a popular manufacturer of computer accessories, including gaming mouses and keyboards.

A local privilege escalation (LPE) zero-day flaw in Razer Synapse allows attackers to gain SYSTEM privileges on Windows systems by plugging in a Razer mouse or keyboard. Razer is a very popular computer peripherals manufacturer that designs, develops, and sells consumer electronics, financial services, and gaming hardware, including gaming mouses and keyboards.

Upon plugging in a Razer device into Windows 10 or Windows 11, the operating system will automatically download and install the Razer Synapse driver and the Razer Synapse software on the computer that allows configuring the devices.

The flaw was discovered by the security researcher jonhat that disclosed it via Twitter:

Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift+Right click

Tried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz

— ҉j҉o҉n҉h҉a҉t҉ (@j0nh4t) August 21, 2021

Once gained SYSTEM privileges in Windows, attackers can completely take over the system.

The expert decided to publicly disclose the issue because he did not receive a response from Razer, he also published a video PoC of the attack:

https://streamable.com/e/q2dsji

Bleeping computer successfully tested the vulnerability, upon plugging the Razer device into Windows 10, the RazerInstaller.exe executable was launched via a Windows process running with SYSTEM privileges. The Razer installation program is also executed with SYSTEM privileges.

The Razer Synapse software setup wizard allows users to select the folder where he wishes to install it. If the attacker click on a ‘Choose a Folder’ dialog and then press on Shift and right-click on the dialog he will be prompted to open ‘Open PowerShell window here,’ which allows to open a PowerShell prompt in the folder shown in the dialog.

The PowerShell prompt is launched by a process with SYSTEM privileges, this means that he will have SYSTEM privileges too.

After the disclosure of the issue, Razer told the researcher that they are working on a fix to address the flaw.

Need local admin and have physical access?
– Plug a Razer mouse (or the dongle)
– Windows Update will download and execute RazerInstaller as SYSTEM
– Abuse elevated Explorer to open Powershell with Shift+Right click

Tried contacting @Razer, but no answers. So here's a freebie pic.twitter.com/xDkl87RCmz

— ҉j҉o҉n҉h҉a҉t҉ (@j0nh4t) August 21, 2021

Razer will also give the researcher a bug bounty reward.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, InkySquid)

[adrotate banner=”5″]

[adrotate banner=”13″]