Windows 10 RCE: The exploit is in the link
positive.security
Windows 10 RCE: The exploit is in the link
1–10 of 58 posts
Re: Windows 10 RCE: The exploit is in the link
#2"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified as "Critical, RCE", but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windows 11)"
So they wrote a protocol-handler bound on every Win10 machine which arbitrarily runs a command if you can convince the user to click one message box.
Re: Windows 10 RCE: The exploit is in the link
#3"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified as "Critical, RCE", but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windo…
And apparently Win11 too.
Don't all protocol handlers invoke some execution? Like http goes to my browser (only Edge) and that other windows internal one which also goes to Edge (and resets my registered http handler)
Re: Windows 10 RCE: The exploit is in the link
#4"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified as "Critical, RCE", but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windo…
> We discovered a drive-by code execution vulnerability on Windows 10 via IE11/Edge Legacy and MS Teams, triggered by an argument injection in the Windows 10/11 default handler for ms-officecmd: URI
> Exploitation through other browsers requires the victim to accept an inconspicuous confirmation dialog.
No confirmation needed with Windows 10 and IE11 or Edge Legacy
Re: Windows 10 RCE: The exploit is in the link
#5Am I understanding this correctly that this exploit uses edge OR simply having teams installed (which is default in windows)?
Are there any community patches for this since microsoft has failed to patch what appears to be a 0 day (especially for windows 10)?
Re: Windows 10 RCE: The exploit is in the link
#6Am I understanding this correctly that this exploit uses edge OR simply having teams installed (which is default in windows)? Are there any community patches for this since microsoft has failed to patch what appears to be a 0 day (especially for windows 10)?
it needs edge or ie11 and teams. It doesn't appear to be a zero click without the use of edge or ie11 so just avoid both of those and you should be okay.
Re: Windows 10 RCE: The exploit is in the link
#7This is one of those bugs that really should never happen, and one wonders how Microsoft could have missed it and failed to take it seriously.
This isn't a particularly sophisticated or novel attack vector, difficult as it was to find; it's the sort of injection attack caused by string interpolation that should have been caught long before anything was shipped.
Re: Windows 10 RCE: The exploit is in the link
#8For a moment, I thought it was yet another research from the people at Positive Technologies (ptsecurity.com), the company that had sanctions from USG. I'm not sure if intentional but you must have gotten that a few times over the last year ? I'm not sure it's the best idea to compete on brand, in the same domain, as a ~1000 people, 20 years old company.
Re: Windows 10 RCE: The exploit is in the link
#9"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified as "Critical, RCE", but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windo…
For everyone reading this, let me translate:
> One of the largest IT Company on this planet, with software running on billions of devices, even in critical infrastructure, would like you to sell exploits to their programs to the open market instead of their bug bounty program.
Re: Windows 10 RCE: The exploit is in the link
#10This is one of those bugs that really should never happen, and one wonders how Microsoft could have missed it and failed to take it seriously. This isn't a particularly sophisticated or novel attack vector, difficult as it was to find; it's the sort of injection attack caused by string interpolation that should have been caught long before anything was shipped.
One architect said so and there is a ticket about it, no one questions things when it comes to implementation.