SandboxEscaper: Local Privilege Escalation Bugs Including Four Zero-Day Vulnerabilities Disclosed

Satnam Narang

Five vulnerabilities, including four zero-day vulnerabilities, have been disclosed in Windows Task Scheduler, Windows Error Reporting, Internet Explorer 11, Microsoft Edge and Windows Installer, which could be used by attackers to elevate privileges.

Background

From May 21 through May 23, a security researcher published proof-of-concept (PoC) code for five vulnerabilities in Windows Task Scheduler (bearlpe), Windows Error Reporting (angrypolarbear2), Internet Explorer 11 (IE11), Microsoft Edge, and Windows Installer. Four of the five vulnerabilities are zero-days. These follow previous public disclosures from this researcher of zero-day vulnerabilities in Windows Task Scheduler in August 2018, Data Sharing Service in October 2018 and ReadFile.exe and Windows Error Reporting (WER) in December 2018.

Analysis

The five vulnerabilities published are named based on the folder names for each PoC:

  • “bearlpe” (zero-day)
  • “angrypolarbear2”
  • “sandboxescape” (zero-day)
  • “CVE-2019-0841-BYPASS” (zero-day)
  • “InstallerBypass” (zero-day)
  • bearlpe targets the Windows Task Scheduler .job import functionality, while angrypolarbear2 targets the WER tool’s reporting queue task. CVE-2019-0841-BYPASS, which targets Microsoft Edge and was originally discovered by another researcher, appears to still be vulnerable. InstallerBypass targets the rollback scripts used when an installation is canceled.

    All four of these vulnerabilities target the writing of discretionary access control lists (DACLs), where some of the vulnerabilities require the usage of native hardlinks.

    The sandboxescape vulnerability works on IE11 and can be combined with an existing IE remote code execution (RCE) vulnerability to break out of IE11's sandbox. Due to a flaw in, or exposed by, the IShdocvwBroker ShowOpenFile() method, a specially crafted HTML file can be evaluated with elevated permissions. When evaluated, this file does not have protected mode enabled. The researcher notes this vulnerability will "work on other sandboxes that allow the opening of windows filepickers through a broker."

    Proof of concept

    The PoCs are available on Github in repository folders called bearlpe, angrypolarbear2, sandboxescape, CVE-2019-0841-BYPASS and InstallerBypass.

    Will Dormann, a vulnerability analyst at CERT/CC, tested the bearlpe PoC and confirmed exploitation succeeds on fully patched Windows 10 32-bit systems, 64-bit systems and Windows Server 2016 and 2019. However, Dormann was not able to reproduce exploitation on Windows 7 or Windows 8 systems.

    Solution

    At the time this blog post was published, four of the five vulnerabilities remain zero-days and Microsoft has not confirmed whether it would patch them in the June 2019 Patch Tuesday release. For angrypolarbear2, it was reported to Microsoft and fixed in the May 2019 Patch Tuesday release and has a CVE identifier of CVE-2019-0863. Interestingly enough, one of the two researchers credited with finding CVE-2019-0863 is named “Polar Bear,” which is the name the researcher uses in their Github Repository name as well. Tenable is continuing to monitor for additional updates regarding the zero-day vulnerabilities.

    Identifying affected systems

    A list of plugins to identify CVE-2019-0863 can be found here.

    Based on the testing of the bearlpe PoC, it appears that Windows 10 32-bit and 64-bit systems are vulnerable as well as Windows Server 2016 and Windows Server 2019. Once Microsoft releases patches for these vulnerabilities, we will update this post to provide a link to the plugins to identify affected systems. Until then, to identify affected assets, we recommend using the following plugins:

    Get more information

    Join Tenable's Security Response Team on the Tenable Community.

    Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

    Read more >

    Published on May 23, 2019

    People also viewed

    Enterprise Territory Manager - Chicago

    Chicago Illinois United States Chicago, Illinois, United States Sales Sales
    Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

    Enterprise Territory Manager - Chicago

    Milwaukee Wisconsin United States Milwaukee, Wisconsin, United States Sales Sales
    Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

    Software Engineer - Web Scraping (Python)

    Remote United States Remote, United States, 97458 Research Engineering
    Your Role:Tenable is looking for a Software Engineer to join our Automation research team.  This position will involve building and maintaining our framework for automated content creation, validation, and deliveryYour Opportunity: Impact: You wi...

    Product Security Architect - Security Development Lifecycle

    Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Security IT
    Your Role:As part of the Information Security team, the Principal Product Security Architect will help drive and coordinate security for Tenable’s applications and services portfolio. This includes designing and working on Security Development Lif...

    Software Engineer

    Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Engineering Engineering
    Your Role:Are you excited about the opportunity to work with microservices at scale? Do you like knowing that the changes that you deploy to production will improve the customer experience of many users worldwide? Do you like both the exciting, fa...

    Software Engineering Manager, UI

    San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
    Your Role:Tenable is looking for an extraordinary Engineering Manager to join the Tenable.io Engineering team. This is an opportunity to make a high impact while helping the team deliver on a next-generation enterprise web application. The ideal c...

    We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.