SEC Consult Vulnerability Lab Security Advisory < 20231123-0 >  
title: Uninstall Key Caching  
product: Fortra Digital Guardian Agent Uninstaller  
(Data Loss Prevention)  
vulnerable version: Agent: <7.9.4  
fixed version: Agent: 7.9.4  
CVE number: CVE-2023-6253  
impact: High  
found: 2023-05-16  
by: J. Kruchem (Office Vienna)  
B. Gründling (Office Vienna)  
D. Hirschberger (Office Bochum)  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
Vendor description:  
"Digital Guardian is proud to be part of Fortra’s comprehensive cybersecurity  
portfolio. Fortra simplifies today’s complex cybersecurity landscape by bringing  
complementary products together to solve problems in innovative ways. These  
integrated, scalable solutions address the fast-changing challenges you face in  
safeguarding your organization. With the help of the powerful protection from  
Digital Guardian and others, Fortra is your relentless ally, here for you every  
step of the way throughout your cybersecurity journey."  
Business recommendation:  
SEC Consult recommends users of this platform to install the latest update.  
Furthermore, an in-depth security analysis performed by security professionals is  
highly advised, as the software may be affected from other security issues.  
Vulnerability overview/description:  
1) Stored Cross-Site Scripting  
The "PDF templates" feature is vulnerable against stored cross-site scripting  
because it allows inserting arbitrary HTML. Therefore, an administrator can  
create a malicious template which contains JavaScript and can send a link to  
this template to authenticated users.  
According to the vendor, this feature works as intended and the associated risk  
is low, hence it will not be fixed.  
2) UninstallKey Cached in Memory / Installer File (CVE-2023-6253)  
The Agent Uninstaller handles sensitive data insecurely and caches the Uninstall  
key in memory. This key can be used to stop or uninstall the application.  
This allows a locally authenticated attacker with administrative privileges  
to disable the application temporarily or even remove the application from the  
system completely.  
Proof of concept:  
1) Stored Cross-Site Scripting  
According to the vendor, this feature works as intended and the associated risk  
is low, hence it will not be fixed.  
When editing PDF templates in the Digital Guardian Management Console (DGMC)  
JavaScript code can be injected. By clicking on "preview" the XSS code gets  
The "PDF templates" feature can be found in the System -> Configuration menu.  
Here, a new template can be uploaded, or an existing one can be edited. To  
exploit the issue, malicious JavaScript can be added to a template:  
Afterwards, the XSS is executed when the template is previewed with the  
corresponding button:  
The attacker can also send the direct link to the template to the victim:  
If a victim opens the link while authenticated, the JavaScript code will  
be executed.  
2) UninstallKey Cached in Memory / Installer File (CVE-2023-6253)  
When executing the installer of the DG Agent (.msi) the uninstall key is  
pre-configured and can be read out (e.g. via Debugging).  
First, the LocalPackage registry hive was identified, which reveals the MSI  
installation package located in the Windows directory:  
The file can be executed without local administrator privileges. When executed  
and clicked "Next", the Uninstall Key is prefilled as can be seen in the  
following figure:  
Note: For demonstration purposes and simplification of the proof of concept, the  
provided administrative access to the management console was used to append a  
unique string to the uninstall key so it can be found in the memory more  
efficiently. An attacker can also find the key without this modification. For  
this purpose, the string "sectest" was appended.  
WinDbg can be used to extract this key. WinDbg can simply be attached to the  
process. Afterwards, the execution is paused in WinDbg and the following command  
is used to search for the unique string:  
> s -u 0 L?FFFFFFFFFFFFFFFF "sectest"  
The following figure shows the output of this command (since a very large memory  
space is searched, "Break" can be used to stop WinDbg from searching).  
The memory space before "sectest" needs to be viewed to show the uninstall key.  
The command db 000001c6`165b63a8 can be used to show the memory, as can be seen  
in the following figure:  
Thus, the original uninstall key is "dlpuninstall".  
Furthermore, it can be used with the Terminator.exe found in the following path:  
"C:\Program Files\[...]\DLP"  
Running the application and supplying the key via an elevated command prompt,  
it terminates all agent processes:  
This binary can also be used to brute-force the correct Uninstall key, by  
repeatedly calling it with possible Uninstall key candidates:  
\.Terminator.exe <key candidate>  
Vulnerable / tested versions:  
The following version has been tested:  
* Management Console:  
* Agent:  
The vendor confirmed that all current and previous versions are affected.  
Vendor contact timeline:  
2023-06-12: Contacting vendor through email (;  
asking for security contact, no response.  
2023-06-26: Contacting vendor through same email again, no response.  
2023-07-28: Contacting vendor through a more direct email-channel, no response.  
2023-09-14: Sent another email to various email addresses found on the  
website. Their "security.txt" file only points to inaccessible  
pages (403 Access denied or 404 for the PGP key).  
2023-09-14: Vendor response (Fortra support contact): forwarded our email to  
Digital Guardian support team.  
Support team and product security team reply.  
2023-09-15: Asked for email encryption, received PGP key.  
2023-09-18: Sending encrypted security advisory.  
2023-09-19: Confirmation of receipt, team is working on verification and  
2023-10-11: Asking for status update.  
Vendor response: XSS could be replicated but functionality works  
as intended and won't be fixed because of limited exposure.  
Issue 2 could not be verified yet, but engineering has acknowledged  
it as addressable. Fix is planned for Q4. All current and previous  
versions are affected.  
2023-10-12: Asking for CVE number and if further input regarding vulnerability 2  
is needed, no response.  
2023-10-17: Received ticket notification that next maintenance update version  
7.9.4 should be available for customer testing in the near future.  
2023-11-09: Received ticket notification that version 7.9.4 is now GA for all  
2023-11-13: Sending advisory draft to vendor, asking for CVE number for issue 2  
again, scheduling advisory release for next week.  
2023-11-17: Vendor response, no CVE number yet, we will request one ourselves.  
2023-11-23: Public release of security advisory.  
The vendor provides an updated Agent version 7.9.4 which can be downloaded  
at the vendor's support page:  
Access controls to the management console along with monitoring and preventive  
controls are recommended compensating controls for issue 1 according to the vendor.  
To prevent disclosure of the uninstall key (issue 2) change it immediately after  
deploying the DG agent on the system.  
Advisory URL:  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
Interested to work with the experts of SEC Consult? Send us your application  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices  
Mail: security-research at sec-consult dot com  
EOF J. Kruchem, B. Gründling, D. Hirschberger / @2023