# Cache Me If You Can: Local Privilege Escalation in Zscaler Client Connector (CVE-2023-41973)

Zscaler Client Connector's SYSTEM RPC service trusted cached PIDs and unsanitized previousInstallerName, letting a standard user chain PID cache collision, password-type confusion, and path traversal to run code as SYSTEM.

- Payout: Research
- Severity: high
- Program: Zscaler Client Connector
- Found by (vendor credit): Singapore GovTech Red Team
- Write-up by: Eugene Lim
- Disclosed: 2024-05-27
- CVE: CVE-2023-41973, CVE-2023-41972
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/zscaler-client-connector-local-privilege-escalation/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation
- Tags: area:os domain:desktop impact:privesc kind:research platform:research sev:high tech:windows technique:chained technique:race-window technique:reverse-engineering vuln:access-control vuln:auth-bypass vuln:path-traversal vuln:privilege-escalation

**Target:** Windows RPC service (ZSATrayManager) and ZSAService binary
**Root cause:** ZSATrayManager validates RPC callers via a non-pruned FNV-1a-hashed PID cache, so PID reuse collides with allowed entries; PERFORM_APP_REVERT also fails to validate pwdType and passes previousInstallerName into a path without sanitization.
**Steps:**
1. Enumerate RPC interface of ZSATrayManager and observe IfCallbackFn PID/Authenticode checks plus in-memory PID cache.
2. Repeatedly kill ZSATray.exe so ZSATrayManager relaunches it, populating cache with many allowed PIDs.
3. Brute-force spawn an exploit binary until Windows assigns a PID present in the cache, bypassing caller validation.
4. Send PERFORM_APP_REVERT RPC with pwdType=SHOW_ADVANCED_SETTINGS (6) to bypass the revert password check (CVE-2023-41972).
5. Set previousInstallerName to `..\..\..\<attacker path>\ZSAService.exe` to traverse out of RevertZcc.
6. Place malicious `userenv.dll` next to ZSAService.exe; ZSATrayManager launches it as SYSTEM, DLL hijack executes payload.
**How found:** Reviewed ZSATray/ZSATrayManager RPC design after CVE-2020-11635, noticed the caller-validation cache keyed by FNV-1a hash of PID is never pruned, hypothesized PID reuse could collide; then audited PERFORM_APP_REVERT handler and found missing pwdType check and unsanitized previousInstallerName, with Authenticode blocking direct payload until DLL hijack in ZSAService was found.
**Exploitation:** Attacker with standard user privileges grooms the PID cache, collides a reused PID to make arbitrary RPC calls, bypasses the revert password via pwdType confusion, then path-traverses previousInstallerName to a Zscaler-signed ZSAService.exe that is vulnerable to userenv.dll hijacking, achieving command execution as NT AUTHORITY\SYSTEM.
**Escalation:** Chained three low-severity bugs (PID cache collision, password type confusion, path traversal) plus a DLL hijack gadget to cross from standard user to SYSTEM.
**Insight:** When a privileged service caches caller validation keyed by PID or other reusable identifiers, check whether the cache is pruned and whether PID reuse lets an attacker collide into an allowed entry; also audit RPC handlers for missing enum/type validation on auth-related parameters.