SandboxEscaper releases Byebear exploit to bypass patched EoP flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0841 | Local Privilege Escalation via Hard-Link Flaw in Windows AppX Deployment Service CVE-2019-0841 is a local privilege escalation flaw in the Windows AppX Deployment Service (AppXSVC), which handles deployment of packaged (AppX) applications. The service improperly handles hard links (CWE-59), letting a local attacker manipulate hard links so that AppXSVC performs file operations in protected locations with elevated rights. A successful exploit allows the attacker to run processes in an elevated context — effectively administrative/SYSTEM privileges — which ransomware operators have used in chained attacks. Any unpatched Microsoft Windows system is potentially affected; the available data lists only 'Microsoft Windows' without specific version ranges, so defenders should consult Microsoft's advisory for exact affected releases. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, and EPSS assigns a 41.4% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is catalogued. Do: Apply Microsoft's Windows cumulative updates per vendor instructions as the KEV required action, prioritizing systems where users can log on locally, since exploitation requires local access; the fix shipped in Microsoft's April 2019 security release, so confirm no hosts remain on older builds. Because ransomware operators chain this local privilege escalation, verify patch status across the estate with your inventory tooling and monitor for unexpected elevation or hard-link manipulation on AppXSVC as interim risk reduction. | 7.8 | 41% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows endpoints potentially in scope (Windows runs on 1B+ active devices, ~70% desktop share), limited to unpatched systems |
Full article479 words · extracted from securityaffairs.com · click to collapse
SandboxEscaper publicly disclosed a second Windows zero-day exploit dubbed ByeBear to bypass a recently patched elevation of privilege issue.
SandboxEscaper is a well of neverending surprises, today publicly disclosed a second Windows zero-day exploit (dubbed ByeBear) to bypass a recently patched elevation of privilege issue.
SandboxEscaper is well-known researchers that publicly disclosed several zero-day exploits for unpatched Windows flaws. At the end of May, she disclosed four Microsoft zero-day flaws in just 24 hours.
One of the flaw could be exploited by an attacker to bypass an elevation of privilege issue in Windows. The flaw, tracked s CVE-2019-0841, was already patched by Windows, it affects the way Windows AppX Deployment Service (AppXSVC) handles hard links.
Evidently, the fix did not completely solve the problem because now SandboxEscaper has developed a new exploit to trigger the flaw bypassing the Microsoft security patch.
The researchers explained that a specially crafted malicious application could be used to escalate its privileges and take complete control of Windows machine.
Below a video PoC for the ByeBear exploit that abuses Microsoft Edge browser to write discretionary access control list (DACL) as SYSTEM privilege.
“It’s going to increase the thread priority to increase our odds of winning the race condition that this exploits. If your VM freezes, it means you either have 1 core or set your VM to have multiple processors instead of multiple cores… which will also cause it to lock up,” wrote SandboxEscaper.
“This bug is most definitely not restricted to the edge. This will be triggered with other packages too. So you can definitely figure out a way to trigger this bug silently without having edge pop up. Or you could probably minimize edge as soon as it launches and closes it as soon as the bug completes.”
“I think it will also trigger by just launching edge once, but sometimes you may have to wait for a little. I didn’t do extensive testing…found this bug and quickly wrote up a PoC, took me like 2 hours total, finding LPEs is easy.”
In August 2018, SandboxEscaper disclosed a first zero-day privilege escalation vulnerability affecting Microsoft’s Windows operating systems.
In 2018, SandboxEscaper has publicly dropped exploits for other two Windows zero-day vulnerabilities forcing Microsoft to quickly address them to avoid its users being targeted by hackers.
In October, SandboxEscaper released the proof-of-concept exploit code for Microsoft Data Sharing that allowed a low privileged user to delete critical system files from Windows systems.
In December, she published a proof-of-concept (PoC) code for a new Windows zero-day, it is the fourth she released this year.
Microsoft plans to release it Patch Tuesday security updates for June on 11th June, and experts believe it will address this ByeBear zero-day and the four previous exploits disclosed by the expert.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – ByeBear, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/86780/hacking/sandboxescaper-byebear-exploit.html