ASUS DriverHub One-Click RCE Vulnerability

This document (source: https://mrbruh.com/asusdriverhub/) describes the discovery and reporting of two security vulnerabilities in ASUS's preinstalled DriverHub software. The author found that the software's local RPC service, which communicates with driverhub.asus.com, inadequately validated the origin of requests, allowing an attacker to potentially send commands from a malicious website with a crafted subdomain. Further investigation revealed a remote code execution (RCE) vulnerability within the software's update function, enabling the execution of arbitrary signed ASUS binaries with administrative privileges by manipulating how the software handled update URLs and silent install configurations. The RCE was achieved through a multi-step exploit chain involving downloading unsigned files and then a signed executable that would then run a downloaded configuration file, ultimately leading to execution of arbitrary code. The author reported the issues to ASUS, who patched the software, and the vulnerabilities were assigned CVEs.