Easily exploitable, unpatched Windows privilege escalation flaw revealed (CVE-2021-36934)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-36934 | Local Privilege Escalation (SeriousSAM/HiveNightmare) in Microsoft Windows 10 CVE-2021-36934 is an elevation of privilege vulnerability in Windows caused by overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. A local attacker who already has the ability to execute low-privileged code on a victim system can leverage the misconfigured ACLs to gain arbitrary code execution with SYSTEM privileges, then install programs, view, change or delete data, or create new accounts with full user rights. Affected products per the CPE data are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, with related coverage noting the bug impacts all Windows 10 versions released in the past 2.5 years and also references Windows 11. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-02-10, confirming in-the-wild exploitation, and EPSS assigns a 67.3% probability of exploitation within 30 days (99th percentile). Mitigation is two-step: installing the security update alone is not sufficient — administrators must also manually delete all shadow copies of system files, including the SAM database, per KB5005357. Do: Apply Microsoft's security update per vendor instructions, then follow KB5005357 to manually delete all shadow copies of system files (including the SAM database), because the update alone does not fully mitigate the vulnerability. Restrict or verify ACLs on the System32 config directory and shadow-copy access if shadow-copy deletion cannot be done immediately, and prioritize patching given the flaw's listing in CISA's Known Exploited Vulnerabilities Catalog. | 7.8 | 67% | KEV |
| masshundreds of millions of Windows 10 devices (every supported feature update from mid-2018 through mid-2021 is in scope) |
Full article495 words · extracted from helpnetsecurity.com · click to collapse
A researcher that goes by the Twitter handle @jonasLyk has unearthed an easily exploitable vulnerability (CVE-2021-36934) in Windows 10 that may allow local non-administrative users to gain administrative-level privileges.
yarh- by now its safe to say that win 10 also vulnerable.
— Jonas L (@jonasLyk) July 19, 2021
About CVE-2021-36934
“An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability,” Microsoft confirmed.
The vulnerability received a CVE number and Microsoft is still investigating which Windows versions are affected and working on a fix.
At the moment, the company has advised on two temporary workarounds, which include restricting access to the contents of %windir%\system32\config, and deleting Volume Shadow Copy Service (VSS) shadow copies. CERT/CC provided helpful instructions on how to do that.
The vulnerability stems from the fact that non-administrative users can read the vulnerable host’s sam (Security Accounts Manager), system, and security Windows Registry hive files.
As noted by researcher Benjamin Delpy and CERT/CC’s Will Dorman, these files can contain hashed passwords for user accounts, the original Windows installation password, DPAPI computer keys (which can be used to decrypt all computer private keys), and more.
Q: what can you do when you have #mimikatz🥝 & some Read access on Windows system files like SYSTEM, SAM and SECURITY?
A: Local Privilege Escalation 🥳
Thank you @jonasLyk for this Read access on default Windows😘 pic.twitter.com/6Y8kGmdCsp
— 🥝 Benjamin Delpy (@gentilkiwi) July 20, 2021
What happens when Microsoft accidentally gives BUILTIN\Users the ability to read the Windows 10 SAM:
Mimikatz lsadump::sam as a non-admin user, for example.
Some installs off of very-recent ISO builds are not vulnerable. But assume you are vulnerable until you prove otherwise. pic.twitter.com/GNTiSUyCgl— Will Dormann (@wdormann) July 20, 2021
CVE-2021-36934 is exploitable only if a VSS shadow copy of the system drive is available. But, as Dormann explained, while VSS shadow copies may not be available in some configurations, “simply having a system drive that is larger that 128GB in size and then performing a Windows Update or installing an MSI will ensure that a VSS shadow copy will be automatically created.”
UPDATE (July 21, 2021, 04:00 a.m. PT):
Kevin Beaumont has released a zero-day PoC exploit for CVE-2021-36934 (aka HiveNightmare).
UPDATE (July 23, 2021, 00:45 a.m. PT):
Microsoft has updated the security advisory to note that the flaw affects various Windows 10 and Windows server versions. They also confirmed that, to mitigate the issue before a fix is release, users / administrators have to both restrict access to the contents of %windir%\system32\config and delete shadow copies to prevent exploitation of this vulnerability.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/07/21/cve-2021-36934/