Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

SandboxEscaper: Local Privilege Escalation Bugs Including Four Zero-Day Vulnerabilities Disclosed

Five vulnerabilities, including four zero-day vulnerabilities, have been disclosed in Windows Task Scheduler, Windows Error Reporting, Internet Explorer 11, Microsoft Edge and Windows Installer, which could be used by attackers to elevate privileges.

Background

From May 21 through May 23, a security researcher published proof-of-concept (PoC) code for five vulnerabilities in Windows Task Scheduler (bearlpe), Windows Error Reporting (angrypolarbear2), Internet Explorer 11 (IE11), Microsoft Edge, and Windows Installer. Four of the five vulnerabilities are zero-days. These follow previous public disclosures from this researcher of zero-day vulnerabilities in Windows Task Scheduler in August 2018, Data Sharing Service in October 2018 and ReadFile.exe and Windows Error Reporting (WER) in December 2018.

Analysis

The five vulnerabilities published are named based on the folder names for each PoC:

  1. “bearlpe” (zero-day)
  2. “angrypolarbear2”
  3. “sandboxescape” (zero-day)
  4. “CVE-2019-0841-BYPASS” (zero-day)
  5. “InstallerBypass” (zero-day)

bearlpe targets the Windows Task Scheduler .job import functionality, while angrypolarbear2 targets the WER tool’s reporting queue task. CVE-2019-0841-BYPASS, which targets Microsoft Edge and was originally discovered by another researcher, appears to still be vulnerable. InstallerBypass targets the rollback scripts used when an installation is canceled.

All four of these vulnerabilities target the writing of discretionary access control lists (DACLs), where some of the vulnerabilities require the usage of native hardlinks.

The sandboxescape vulnerability works on IE11 and can be combined with an existing IE remote code execution (RCE) vulnerability to break out of IE11's sandbox. Due to a flaw in, or exposed by, the IShdocvwBroker ShowOpenFile() method, a specially crafted HTML file can be evaluated with elevated permissions. When evaluated, this file does not have protected mode enabled. The researcher notes this vulnerability will "work on other sandboxes that allow the opening of windows filepickers through a broker."

Proof of concept

The PoCs are available on Github in repository folders called bearlpe, angrypolarbear2, sandboxescape, CVE-2019-0841-BYPASS and InstallerBypass.

Will Dormann, a vulnerability analyst at CERT/CC, tested the bearlpe PoC and confirmed exploitation succeeds on fully patched Windows 10 32-bit systems, 64-bit systems and Windows Server 2016 and 2019. However, Dormann was not able to reproduce exploitation on Windows 7 or Windows 8 systems.

Solution

At the time this blog post was published, four of the five vulnerabilities remain zero-days and Microsoft has not confirmed whether it would patch them in the June 2019 Patch Tuesday release. For angrypolarbear2, it was reported to Microsoft and fixed in the May 2019 Patch Tuesday release and has a CVE identifier of CVE-2019-0863. Interestingly enough, one of the two researchers credited with finding CVE-2019-0863 is named “Polar Bear,” which is the name the researcher uses in their Github Repository name as well. Tenable is continuing to monitor for additional updates regarding the zero-day vulnerabilities.

Identifying affected systems

A list of plugins to identify CVE-2019-0863 can be found here.

Based on the testing of the bearlpe PoC, it appears that Windows 10 32-bit and 64-bit systems are vulnerable as well as Windows Server 2016 and Windows Server 2019. Once Microsoft releases patches for these vulnerabilities, we will update this post to provide a link to the plugins to identify affected systems. Until then, to identify affected assets, we recommend using the following plugins:

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,275

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, email, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.