Is it just me or is $50k USD a terrible offer for an exploit like this one.
Usually, if you successfully exploit a smart contract or DAO, you make multiple 100k sometimes even millions for disclosing.
Windows 10 RCE: The exploit is in the link
11–20 of 58 posts
Re: Windows 10 RCE: The exploit is in the link
#12Am I understanding this correctly that this exploit uses edge OR simply having teams installed (which is default in windows)? Are there any community patches for this since microsoft has failed to patch what appears to be a 0 day (especially for windows 10)?
You would need Teams installed AND an application that opens the malicious link. IE11 and Edge Legacy do that without prompting the user, other browsers display a confirmation dialog.
There is a patch addressing the specific exploit path via MS Teams.
The underlying argument injection in LocalBridge.exe (which is the binary processing the JSON payload) is still present, which can be exploited to open other office apps with injected command line arguments. Someone might find another way to run arbitrary code using command line switches other than --gpu-launcher
Re: Windows 10 RCE: The exploit is in the link
#13People with technical knowledge who prefer to use Windows should have their brains examined.
Re: Windows 10 RCE: The exploit is in the link
#14Scheme handlers are like cruise-control for CVEs on every OS, you should avoid using them at all costs, and if you have to, be *extremely* strict on what you allow them to do. Minimizing attack surface is your #1 goal.
Likewise, every Electron app needs to scan its own command-line arguments and refuse to start if...basically anything... is set. It is Unfortunate that Electron in its default configuration allows so many plainly unsafe parameters (--proxy-server also an insanely dangerous one).
Re: Windows 10 RCE: The exploit is in the link
#15To see how it works on your machine, simply paste
ms-officecmd:
into your browser and then see what happens.
In MS Edge you _might_ see a popup window This site is trying to open LocalBridge. A website wants to open this application.
Other forms of URI in Windows 10 taken from https://www.tenforums.com/tutorials/78214-settings-pages-lis... So paste the below into your Browser ms-settings:nightlight In MS Edge you will see a popup saying This site is trying to open Settings. A Website wants to open this application.
Not knocking the research effort was this found using some automation fuzzing? And are many people still using IE11/Edge Legacy ?
Re: Windows 10 RCE: The exploit is in the link
#16"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely."
I recently ran into a similar issue with MSRC. I reported two exactly similar(near perfect) heap overflows exploitable from a local perspective with some time in between. The first report was awarded the maximum payout, and patched as 'Important'.
Meanwhile, MSRC changed its rules related local exploitation. Now, to obtain that, one needs to show the exploit working in the most hardened sandbox processes on the system. From my perspective this is quite unfair, both bugs are reported with the same severity to Microsoft's own customers. Both breach about 3 defined security boundaries (process, session and user). So, my communication stayed the same (all technical details), Microsoft's communication with _their_ customers stayed the same (important severity issue, 7.8 cvss), the only thing changed was my reward...(reason: ohh, it's not a sandboxed process, to we don't care.).
The only way to obtain the maximum payout is this even more stringent, and new, requirement of 'sandboxed process' -> 'other user' boundary. As if there are not a hundred thousand organizations sharing machines between users using Citrix and terminal and other similar technologies...
In any case, given that it takes close to a year, with hundreds of hours invested to uncover such a bug... I'm going to take my submissions elsewhere...
Re: Windows 10 RCE: The exploit is in the link
#17Am I understanding this correctly that this exploit uses edge OR simply having teams installed (which is default in windows)? Are there any community patches for this since microsoft has failed to patch what appears to be a 0 day (especially for windows 10)?
it needs edge or ie11 and teams. It doesn't appear to be a zero click without the use of edge or ie11 so just avoid both of those and you should be okay.
Easier said than done in many corporate environments unfortunately.
Re: Windows 10 RCE: The exploit is in the link
#18Am I understanding this correctly that this exploit uses edge OR simply having teams installed (which is default in windows)? Are there any community patches for this since microsoft has failed to patch what appears to be a 0 day (especially for windows 10)?
>having teams installed (which is default in windows)
Teams is not default in Windows (at least my install) - I don't have it and when I have to do meetings in Teams and I am on my Windows machine I just open the meeting in Chrome.
Re: Windows 10 RCE: The exploit is in the link
#19People with technical knowledge who prefer to use Windows should have their brains examined.
Except for when you want to play certain games or use Microsoft Office to view proprietary .DOCX documents. I would say don't connect Windows to the Internet, but some games need Internet access to run, so you would be at a loss there. Messing with Office documents can be done offline however :)
Re: Windows 10 RCE: The exploit is in the link
#20This is one of those bugs that really should never happen, and one wonders how Microsoft could have missed it and failed to take it seriously. This isn't a particularly sophisticated or novel attack vector, difficult as it was to find; it's the sort of injection attack caused by string interpolation that should have been caught long before anything was shipped.
I've used Windows since 3.1, but I think this new direction is the beginning of the end for Windows. Combining an OS that relies heavily on remote services, with engineers that don't understand security, is a recipe for disaster. At the drop of a hat your OS can break because some remote service breaks[1], or worse, your system gets compromised because the attack surface has grown to size of a small country. I don't want to be one of the inevitable victims. I'm switching to Linux for my next build.
[1]: https://www.xda-developers.com/microsoft-breaks-windows-11-b...