Novel Exploit Chain Enables Windows UAC Bypass

Researchers have flagged a weak point they’re monitoring as CVE-2024-6769, calling it a mixture person entry management (UAC) bypass/privilege escalation vulnerability in Home windows. It might permit an authenticated attacker to get hold of full system privileges, they warned.

That is in line with Fortra, which assigned the issue a medium severity rating of 6.7 out of 10 on the Frequent Vulnerability Scoring System (CVSS) scale. Its proof-of-concept exploit demonstrates that “you may have the power to close down the system,” pressured Tyler Reguly, affiliate director of safety R&D at Fortra. “There are particular places on the drive the place you possibly can write and delete recordsdata that you just could not beforehand.” That features, for instance, C:Home windows, so an attacker might take possession over recordsdata owned by SYSTEM.

For its half, Microsoft acknowledged the analysis however mentioned it doesn’t contemplate this an precise vulnerability, as a result of it falls underneath its idea of acceptability to have “non-robust” safety boundaries.

Understanding Integrity Ranges in Home windows

To know Fortra’s findings, we’ve to return to Home windows Vista, when Microsoft launched the mannequin of Obligatory Integrity Management (MIC). Merely put, MIC assigned each person, course of, and useful resource a degree of entry, known as an integrity degree. Low integrity ranges had been afforded to all, medium for authenticated customers, excessive for directors, and system for less than probably the most delicate and highly effective.

Alongside these integrity ranges got here UAC, a safety mechanism that runs most processes and purposes on the medium degree by default, and requires express permission for any actions that require larger privileges than that. Usually, an admin-level person can improve just by right-clicking a command immediate and choosing “Run as Administrator.”

By combining two exploit methods, Fortra researchers demonstrated of their proof of idea how an already-authorized person might slither by way of this method, leaping throughout the safety boundary imposed on the medium integrity degree to acquire full administrative privileges, all with out triggering UAC.

Utilizing CVE-2024-6769 to Soar Throughout Person Boundaries

To use CVE-2024-6769, an attacker first will need to have a foothold in a focused system. This requires the medium integrity-level privileges of a mean person, and the account from which the assault is triggered should belong to the system’s administrative group (the kind of account that would degree as much as admin privileges, if not for UAC being in its method).

Step one within the assault includes remapping the targeted system’s root drive — resembling “C:” — to a location underneath their management. This will even shift the “system32” folder, which many companies depend on to load crucial system recordsdata.

One such service is the CTF Loader, ctfmon.exe, which runs with out administrator privileges at a excessive integrity degree. If the attacker locations a specifically crafted, copycat DLL within the copycat system32 folder, ctfmon.exe will load it and execute the attacker’s code at that top integrity degree.

Subsequent, if the attacker needs to acquire full administrative privileges, they’ll poison the activation context cache, which Home windows makes use of to load particular variations of libraries. To do that, they craft an entry within the cache pointing to a malicious model of a official system DLL, contained in an attacker-generated folder. By means of a specifically crafted message to the Consumer/Server Runtime Subsystem (CSRSS) server, the faux file is loaded by a course of that has administrator privileges, granting the attacker full management over the system.

Microsoft: Not a Vulnerability

Regardless of the potential for privilege escalation, Microsoft refused to just accept the problem as a vulnerability. After Fortra reported it, the corporate responded by pointing to the “non-boundaries” part of the Microsoft Security Servicing Criteria for Windows, which outlines how “some Home windows elements and configurations are explicitly not meant to offer a strong safety boundary.” Below the pertinent “Administrator to Kernel” part, it reads:

Basically, Reguly explains, “They see the admin-to-system boundary as a nonexistent boundary, as a result of admin is trusted on a number.” In different phrases, Microsoft would not contemplate CVE-2024-6769 a vulnerability if an admin person might finally carry out the identical system-level actions anyway, topic to UAC approval.

In a press release to Darkish Studying, a Microsoft spokesperson highlighted that “The strategy requires membership within the Administrator group, so the so-called approach is simply leveraging an meant permission or privilege which doesn’t cross a safety boundary.”

Reguly and Fortra disagree with Microsoft’s perspective. “When UAC was launched, I believe we had been all bought on the concept that UAC was this nice new safety function, and Microsoft has a historical past of fixing bypasses for safety features,” he says. “So in the event that they’re saying that it is a belief boundary that’s acceptable to traverse, actually what they’re saying to me is that UAC will not be a safety function. It is some kind of useful mechanism, however it’s not truly safety associated. I believe it is a actually sturdy philosophical distinction.”

Home windows Retailers Ought to Nonetheless Beware UAC Bypass Threat

Philosophical variations apart, Reguly stresses that companies want to concentrate on the chance in permitting lower-integrity admins to escalate their privileges to realize full system controls.

On the finish of a CVE-2024-6769 exploit, an attacker would have full reign to control or delete crucial system recordsdata, add malware, set up persistence, disable safety features, entry probably delicate knowledge, and extra.

“Fortunately, solely directors are impacted by this, which signifies that most of your customary customers are unaffected,” Fortra famous in an FAQ to reporters. “For directors, you will need to guarantee that you’re not working binaries whose origins can’t be verified. For these admins, nonetheless, vigilance is the perfect protection in the mean time.”