SandboxEscaper: Local Privilege Escalation Bugs Including Four Zero-Day Vulnerabilities Disclosed

Satnam Narang

Five vulnerabilities, including four zero-day vulnerabilities, have been disclosed in Windows Task Scheduler, Windows Error Reporting, Internet Explorer 11, Microsoft Edge and Windows Installer, which could be used by attackers to elevate privileges.

Background

From May 21 through May 23, a security researcher published proof-of-concept (PoC) code for five vulnerabilities in Windows Task Scheduler (bearlpe), Windows Error Reporting (angrypolarbear2), Internet Explorer 11 (IE11), Microsoft Edge, and Windows Installer. Four of the five vulnerabilities are zero-days. These follow previous public disclosures from this researcher of zero-day vulnerabilities in Windows Task Scheduler in August 2018, Data Sharing Service in October 2018 and ReadFile.exe and Windows Error Reporting (WER) in December 2018.

Analysis

The five vulnerabilities published are named based on the folder names for each PoC:

  • “bearlpe” (zero-day)
  • “angrypolarbear2”
  • “sandboxescape” (zero-day)
  • “CVE-2019-0841-BYPASS” (zero-day)
  • “InstallerBypass” (zero-day)
  • bearlpe targets the Windows Task Scheduler .job import functionality, while angrypolarbear2 targets the WER tool’s reporting queue task. CVE-2019-0841-BYPASS, which targets Microsoft Edge and was originally discovered by another researcher, appears to still be vulnerable. InstallerBypass targets the rollback scripts used when an installation is canceled.

    All four of these vulnerabilities target the writing of discretionary access control lists (DACLs), where some of the vulnerabilities require the usage of native hardlinks.

    The sandboxescape vulnerability works on IE11 and can be combined with an existing IE remote code execution (RCE) vulnerability to break out of IE11's sandbox. Due to a flaw in, or exposed by, the IShdocvwBroker ShowOpenFile() method, a specially crafted HTML file can be evaluated with elevated permissions. When evaluated, this file does not have protected mode enabled. The researcher notes this vulnerability will "work on other sandboxes that allow the opening of windows filepickers through a broker."

    Proof of concept

    The PoCs are available on Github in repository folders called bearlpe, angrypolarbear2, sandboxescape, CVE-2019-0841-BYPASS and InstallerBypass.

    Will Dormann, a vulnerability analyst at CERT/CC, tested the bearlpe PoC and confirmed exploitation succeeds on fully patched Windows 10 32-bit systems, 64-bit systems and Windows Server 2016 and 2019. However, Dormann was not able to reproduce exploitation on Windows 7 or Windows 8 systems.

    Solution

    At the time this blog post was published, four of the five vulnerabilities remain zero-days and Microsoft has not confirmed whether it would patch them in the June 2019 Patch Tuesday release. For angrypolarbear2, it was reported to Microsoft and fixed in the May 2019 Patch Tuesday release and has a CVE identifier of CVE-2019-0863. Interestingly enough, one of the two researchers credited with finding CVE-2019-0863 is named “Polar Bear,” which is the name the researcher uses in their Github Repository name as well. Tenable is continuing to monitor for additional updates regarding the zero-day vulnerabilities.

    Identifying affected systems

    A list of plugins to identify CVE-2019-0863 can be found here.

    Based on the testing of the bearlpe PoC, it appears that Windows 10 32-bit and 64-bit systems are vulnerable as well as Windows Server 2016 and Windows Server 2019. Once Microsoft releases patches for these vulnerabilities, we will update this post to provide a link to the plugins to identify affected systems. Until then, to identify affected assets, we recommend using the following plugins:

    Get more information

    Join Tenable's Security Response Team on the Tenable Community.

    Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

    Read more >

    Published on May 23, 2019

    People also viewed

    Business Cost Analyst - Cloud Infrastructure

    San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
    Your Role:Tenable is seeking a Business Cost Analyst of Cloud Infrastructure with strong MS Excel experience to assess, analyze and compile current costs and potentially determine initiatives to reduce and improve our cloud infrastructure cost for...

    Professional Services Engagement Manager

    Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Professional Services Professional Services
    Your Role:The Professional Services Engagement Manager assists in the professional services business development and oversees the delivery of projects. The Professional Services Engagement Manager’s roles include tactical project management oversi...

    UX Designer

    Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Engineering Engineering
    Your Role:Tenable is looking for an extraordinary Senior UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital sec...

    Commercial Territory Manager - West

    Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sales Sales
    Your Role:The Commercial Territory Manager will meet and exceed quarterly sales quota by developing new opportunities within specific geographical territory.  Researching and identifying potential accounts; outbound cold calling to soliciting new ...

    Senior Software Engineer (Java & Kotlin)

    San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
    Your Role:Tenable is looking for a Senior Software Engineer to join the Lumin product development team. As a Sr. Software Engineer you will drive projects end-to-end, collaborate on product requirements with Product Managers, architect and impleme...

    Public Sector Channel Manager - Distribution

    Reston Virginia United States Reston, Virginia, United States Channel Sales Sales
    Your Role:The Public Sector Channel Manager-Distribution is responsible for establishing and managing relationships with the Distribution Partner(s).  The CM-Disty will act as a sales liaison between distributor and Tenable Channel Manager personn...

    We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.