SandboxEscaper: Local Privilege Escalation Bugs Including Four Zero-Day Vulnerabilities Disclosed

Five vulnerabilities, including four zero-day vulnerabilities, have been disclosed in Windows Task Scheduler, Windows Error Reporting, Internet Explorer 11, Microsoft Edge and Windows Installer, which could be used by attackers to elevate privileges.

Background

From May 21 through May 23, a security researcher published proof-of-concept (PoC) code for five vulnerabilities in Windows Task Scheduler (bearlpe), Windows Error Reporting (angrypolarbear2), Internet Explorer 11 (IE11), Microsoft Edge, and Windows Installer. Four of the five vulnerabilities are zero-days. These follow previous public disclosures from this researcher of zero-day vulnerabilities in Windows Task Scheduler in August 2018, Data Sharing Service in October 2018 and ReadFile.exe and Windows Error Reporting (WER) in December 2018.

Analysis

The five vulnerabilities published are named based on the folder names for each PoC:

1. “bearlpe” (zero-day)
2. “angrypolarbear2”
3. “sandboxescape” (zero-day)
4. “CVE-2019-0841-BYPASS” (zero-day)
5. “InstallerBypass” (zero-day)

bearlpe targets the Windows Task Scheduler .job import functionality, while angrypolarbear2 targets the WER tool’s reporting queue task. CVE-2019-0841-BYPASS, which targets Microsoft Edge and was originally discovered by another researcher, appears to still be vulnerable. InstallerBypass targets the rollback scripts used when an installation is canceled.

All four of these vulnerabilities target the writing of discretionary access control lists (DACLs), where some of the vulnerabilities require the usage of native hardlinks.

The sandboxescape vulnerability works on IE11 and can be combined with an existing IE remote code execution (RCE) vulnerability to break out of IE11's sandbox. Due to a flaw in, or exposed by, the IShdocvwBroker ShowOpenFile() method, a specially crafted HTML file can be evaluated with elevated permissions. When evaluated, this file does not have protected mode enabled. The researcher notes this vulnerability will "work on other sandboxes that allow the opening of windows filepickers through a broker."

Proof of concept

The PoCs are available on Github in repository folders called bearlpe, angrypolarbear2, sandboxescape, CVE-2019-0841-BYPASS and InstallerBypass.

Will Dormann, a vulnerability analyst at CERT/CC, tested the bearlpe PoC and confirmed exploitation succeeds on fully patched Windows 10 32-bit systems, 64-bit systems and Windows Server 2016 and 2019. However, Dormann was not able to reproduce exploitation on Windows 7 or Windows 8 systems.

Solution

At the time this blog post was published, four of the five vulnerabilities remain zero-days and Microsoft has not confirmed whether it would patch them in the June 2019 Patch Tuesday release. For angrypolarbear2, it was reported to Microsoft and fixed in the May 2019 Patch Tuesday release and has a CVE identifier of CVE-2019-0863. Interestingly enough, one of the two researchers credited with finding CVE-2019-0863 is named “Polar Bear,” which is the name the researcher uses in their Github Repository name as well. Tenable is continuing to monitor for additional updates regarding the zero-day vulnerabilities.

Identifying affected systems

A list of plugins to identify CVE-2019-0863 can be found here.

Based on the testing of the bearlpe PoC, it appears that Windows 10 32-bit and 64-bit systems are vulnerable as well as Windows Server 2016 and Windows Server 2019. Once Microsoft releases patches for these vulnerabilities, we will update this post to provide a link to the plugins to identify affected systems. Until then, to identify affected assets, we recommend using the following plugins:

• Microsoft Internet Explorer Version Detection
• Microsoft Internet Explorer Version Detection (NNM)
• Microsoft Edge Browser Installed
• Microsoft Edge Browser Detection (NNM)
• OS Identification (OS Version displayed in the Plugin Output)
• Windows 10 Operating System Detection (NNM)

Get more information

• Github Repository for bearlpe
• Github Repository for angrypolarbearbug2
• Github Repository for sandboxescape
• Github Repository for CVE-2019-0841-BYPASS
• Github Repository for InstallerBypass

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.