A zero-day vulnerability in Razer external device installation software – be it a razer mouse, a keyboard, or any other equipment using the synapse program – offers complete admin privileges to the admin using Windows 10 by plugging and installing a relevant peripheral system.
Razer is indeed a prominent developer of gameplay mouses and keyboards and is known for providing the best computer accessories. Razer Inc. is a multinational corporation in Singapore that creates, manufactures, and sells electronics, financial services, and games consoles for consumer products.
However, talking about windows 11, there isn’t any proof yet if it allows the same privileges to the user or not while pugging Razer peripherals. Whereas the vulnerability has nothing with it that won't allow a user to gain access but since the testing on windows 11 hasn’t been done yet, speculations cannot be made.
In this case, the OS immediately downloads and starts the system installation of the Razer Synapse software whenever users plug a Razer hardware into Windows 10 computer system. Razer Synapse is software that enables users to set up hardware, macros, or map buttons for their hardware devices.
Security researcher Jonhat (@j0nh4t) disclosed the flaw and tweeted about it on Twitter on Saturday 21st August, after not receiving any response from Razer initially. The tweet had been receiving attention from Razer as of Sunday 22nd August and the maker has told Jonhat that their cybersecurity team is working on a patch for this issue, to fix it at the earliest. Perhaps they gave Jonhat a bug bounty reward as well.
In the words of the researcher, as well as Bleeping Computer too has proved in the testing itself, that Windows automatically selects an installer containing driver software and a synapse utility when a user plugs into a Razer device (or dongle if this is a wireless device). The activation of Razer Synapse Plug-and-play enables users to obtain SYSTEM permissions on the lickety-split Windows device because it displays an Explorer window as part of the set-up process, which tells users where and how to set up the driver.
The topmost user permission level in Windows is SYSTEM Privileges: A SYSTEM account enables someone to acquire full control over the system, permitting them to see, alter or delete data; to establish new accounts having full privileges of users, and to install anything – malware included.
The installation method for Synapse, in other terms, works with Windows 10 with the maximum privileges. The installation application Razer was given the very same administrator rights as the RazerInstaller.exe executable with SYSTEM privileges, which has been launched via a Windows process.
Jonhat has established that a "Choose a Folder" popup will be displayed if a user decides to modify the default installation folder location. One may right-click the installation window and click the Shift key which launches a certain PowerShell terminal with the same privileges.
Similar problems are probably identified in other products installed through Windows plug-and-play processes, as indicated by Will Dormann, a CERT/CC vulnerability analyst.
