Unpatched Windows Zero-Day Allows Privileged File Access
A temporary fix has been issued for CVE-2021-24084, which can be exploited using the LPE exploitation approach for the HiveNightmare/SeriousSAM bug.
<div class="c-article__content js-reading-content"> <p>An unpatched Windows security vulnerability could allow information disclosure and local privilege escalation (LPE), researchers have warned. The issue (CVE-2021-24084) has yet to get an official fix, making it a zero-day bug – but a micropatch has been rolled out as a stop-gap measure.</p> <p>Security researcher Abdelhamid Naceri <a href="https://halove23.blogspot.com/2021/06/CVE-2021-24084-Unpatched-ID.html" target="_blank" rel="noopener">originally reported</a> the vulnerability as an information-disclosure issue in October 2020, via Trend Micro’s Zero-Day Initiative (ZDI). Though Microsoft had told him it was planning a fix for last April, the patch has not yet been forthcoming.</p> <p><a href="https://threatpost.com/infosec-insider-subscription-page/?utm_source=ART&utm_medium=ART&utm_campaign=InfosecInsiders_Newsletter_Promo/" target="_blank" rel="noopener"><img loading="lazy" class="aligncenter wp-image-168544 size-full" src="https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/infosec_insiders_in_article_promo.png" alt="Infosec Insiders Newsletter" width="700" height="50"></a></p> <p>Then, this month, Naceri discovered that CVE-2021-24084 could also be exploited for LPE, so that non-admin Windows users can read arbitrary files even if they do not have permissions to do so. In a proof-of-concept exploit, he demonstrated that it’s possible to copy files from a chosen location into a Cabinet (.CAB) archive that the user can then open and read.</p> <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> <p lang="en" dir="ltr">I mean this is still unpatched and allow LPE if shadow volume copies are enabled; <br>But I noticed that it doesn't work on windows 11 <a href="https://t.co/HJcZ6ew8PO">https://t.co/HJcZ6ew8PO</a></p> <p>— Abdelhamid Naceri (@KLINIX5) <a href="https://twitter.com/KLINIX5/status/1460338968780804098?ref_src=twsrc%5Etfw">November 15, 2021</a></p></blockquote> <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p> <p>The process for doing so is very similar to the <a href="https://www.hackingarticles.in/windows-privilege-escalation-hivenightmare/" target="_blank" rel="noopener">LPE exploitation approach</a> for the HiveNightmare bug, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934" target="_blank" rel="noopener">CVE-2021-36934</a><strong>,</strong> which affects the Security Accounts Manager (SAM) database in all versions of Windows 10. The SAM component in Windows houses user account credentials and network domain information – a juicy target for attackers.</p> <p>“As <a href="https://threatpost.com/win-10-serioussam/168034/" target="_blank" rel="noopener">HiveNightmare/SeriousSAM</a> has taught us, an arbitrary file disclosure can be upgraded to local privilege escalation if you know which files to take and what to do with them,” Mitja Kolsek, head of the 0patch team, noted in a <a href="https://blog.0patch.com/2021/11/micropatching-unpatched-local-privilege.html" target="_blank" rel="noopener">recent posting</a>. “We confirmed this [for the zero-day and were] able to run code as local administrator.”</p> <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> <p lang="en" dir="ltr">It's still hilarious that this bug is still unpatched and fully functional on a windows 10 21H1 with october patch. <a href="https://t.co/HO4Kwbql9z">https://t.co/HO4Kwbql9z</a></p> <p>— Abdelhamid Naceri (@KLINIX5) <a href="https://twitter.com/KLINIX5/status/1455500874596356098?ref_src=twsrc%5Etfw">November 2, 2021</a></p></blockquote> <p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p> <h2><strong>Windows 10 Bug Exploitation Details</strong></h2> <p>Specifically, the vulnerable functionality exists under the “access work or school” settings, according to the opatch writeup. A normal user can make use of the “export your management log files” function, which triggers the Device Management Enrollment Service.</p> <p>“This service first copies some log files to the C:\ProgramData\Microsoft\MDMDiagnostics folder, and then packages them into a .CAB file whereby they’re temporarily copied to C:\Windows\Temp folder,” explained Kolsek. “The resulting .CAB file is then stored in the C:\Users\Public\Public Documents\MDMDiagnostics folder, where the user can freely access it.”</p> <p>However, when the .CAB file is copied into the Windows Temp folder, a local attacker can pounce. The adversary would simply create a file shortcut link with a predictable file name that would normally be used in the normal export process, pointing to a target folder or file that the attacker would like to access.</p> <p>“Since the Device Management Enrollment Service runs as Local System, it can read any system file that the attacker can’t,” Kolsek said.</p> <p>There are two pre-requisites for achieving LPE, Kolsek noted.</p> <p>“System protection must be enabled on drive C, and at least one restore point created. Whether system protection is enabled or disabled by default depends on various parameters,” he said. And, “at least one local administrator account must be enabled on the computer, or at least one ‘administrators’ group member’s credentials cached.”</p> <p>To address the issue, the free micropatch simply checks for the presence of short-cut links during the .CAB file creation.</p> <p>“The function we patched is CollectFileEntry inside mdmdiagnostics.dll. This is the function that copies files from C:\Windows\Temp folder into the .CAB file, and can be tricked into reading some other files instead,” Kolsek explained. “Our patch is placed immediately before the call to CopyFileW that opens the source file for copying, and uses the GetFinalPathNameByHandleW function to determine whether any junctions or other types of links are used in the path. If they are, our patch makes it look as it the CopyFileW call has failed, thereby silently bypassing the copying of any file that doesn’t actually reside in C:\Windows\Temp.”</p> <p>Vulnerable versions of Windows include:</p> <ul> <li>Windows 10 v21H1 (32 & 64 bit) updated with November 2021 Updates</li> <li>Windows 10 v20H2 (32 & 64 bit) updated with November 2021 Updates</li> <li>Windows 10 v2004 (32 & 64 bit) updated with November 2021 Updates</li> <li>Windows 10 v1909 (32 & 64 bit) updated with November 2021 Updates</li> <li>Windows 10 v1903 (32 & 64 bit) updated with November 2021 Updates</li> <li>Windows 10 v1809 (32 & 64 bit) updated with May 2021 Updates</li> </ul> <p>Windows Servers are not affected, and neither are Windows 11, Windows 10 v1803 and older Windows 10 versions.</p> <p>Microsoft did not immediately return a request for comment on the timeline for an official patch.</p> <p><strong><em>There’s a sea of unstructured data on the internet relating to the latest security threats. </em></strong><strong><em><a href="https://threatpost.com/webinars/security-threats-natural-language-processing/?utm_source=In+Article&utm_medium=article&utm_campaign=Decoding+the+Data+Ocean:+Security+Threats+%26+Natural+Language+Processing&utm_id=In+Article" target="_blank" rel="noopener">REGISTER TODAY</a></em></strong><strong><em> to learn key concepts of natural language processing (NLP) and how to use it to navigate the data ocean and add context to cybersecurity threats (without being an expert!). This <a href="https://threatpost.com/webinars/security-threats-natural-language-processing/?utm_source=In+Article&utm_medium=article&utm_campaign=Decoding+the+Data+Ocean:+Security+Threats+%26+Natural+Language+Processing&utm_id=In+Article" target="_blank" rel="noopener">LIVE, interactive Threatpost Town Hall</a>, sponsored by Rapid 7, will feature security researchers Erick Galinkin of Rapid7 and Izzy Lazerson of IntSights (a Rapid7 company), plus Threatpost journalist and webinar host, Becky Bracken.</em></strong></p> <p><a href="https://threatpost.com/webinars/security-threats-natural-language-processing/?utm_source=In+Article&utm_medium=article&utm_campaign=Decoding+the+Data+Ocean:+Security+Threats+%26+Natural+Language+Processing&utm_id=In+Article" target="_blank" rel="noopener"><strong><em>Register NOW</em></strong></a><em><strong> for the LIVE event!</strong></em></p> <footer class="c-article__footer"> <div class="c-article__footer__container"> <div class="c-article__footer__col"> <a href="#discussion" class="c-button c-button--secondary">Write a comment</a> </div> <div class="c-article__footer__col"> <div class="c-article__sharing"> <p><strong>Share this article:</strong></p> <nav class="c-nav-sharing"> <div class="social-likes social-likes_notext" data-title="Unpatched Windows Zero-Day Allows Privileged File Access" data-url="https://threatpost.com/unpatched-windows-zero-day-privileged-file-access/176609/" data-counters="no" data-zeroes="yes"><div class="facebook" title="Share via Facebook"></div> <div class="twitter" title="Share via Twitter"></div><div class="linkedin" title="Share via LinkedIn"></div> <div class="reddit" title="Share via Reddit"></div> <div class="flipboard" title="Share via Flipboard"></div> </div> </nav> </div> </div> </div> <div class="c-article__footer__container"> <div class="c-article__footer__col"></div> <div class="c-article__footer__col"> <ul class="c-list-categories"> <li><a class="c-label c-label--secondary-transparent" href="https://threatpost.com/category/privacy/">Privacy</a></li> <li><a class="c-label c-label--secondary-transparent" href="https://threatpost.com/category/vulnerabilities/">Vulnerabilities</a></li> </ul> </div> </div> </footer> </div>
