High
CVE-2023-36874
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2023-36874
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Windows Error Reporting Service Elevation of Privilege Vulnerability
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityMedium
Technical Analysis
CVE-2023-36874 is a filesystem redirection vulnerability that relies on a trusted process using relative filepath data and poor file validation to allow a malicious actor to escalate privilege on Windows 10 hosts.
How it is supposed to work
The Windows Error Reporting Service (WER) is a privileged (SYSTEM) process that handles errors on Windows systems. It is not meant for user interaction, so many of the ways to interact with it are undocumented COM interfaces.
Through a non-trivial set of calls to COM objects, a user can create an IWerReport
COM object. Once the user has that object, they can make a call to submit a report file associated with that object. The file must be located in %PROGRAMDATA%\Microsoft\Windows\WER\ReportArchive\<reportdir>\
.
As part of the report submission process, the WER
service calls CreateProcess
and passes it the executable responsible for handling the WER
report, %WINDIR%\system32\wermgr.exe
. This results in the wermgr.exe
process launching as SYSTEM
and handling the reporting.
The Vulnerability
There are two issues at play fort his vulnerability: one is that rather than using the absolute filepath to the wermgr.exe
file as above, the CreateProcess
function is handed a relative filepath to the wermgr.exe
executable based on the location of the error report, so the WER
service launches ..\..\..\..\..\..\system32\wermgr.exe
with the origination directory as the directory containing the WER
report to submit, and the second is that neither file is checked for a symbolic link before it is opened.
That means that a user can:
- Create a
WER
report inC:\arbitrary_dir\ProgramData\Microsoft\Windows\WER\ReportArchive\Report\<report_dir>\Report.wer
- Place any executable in
C:\arbitrary_dir\system32\
namedwermgr.exe
- Create a symbolic link between
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\<reportdir>\
andC:\arbitrary_dir\ProgramData\Microsoft\Windows\WER\ReportArchive\Report\<report_dir>\
- Create the
IWerReport
COM object
- Submit the COM object paired with the report in
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\<reportdir>\
This results in..\..\..\..\..\..\system32\wermgr.exe
being opened as system, and as the symlink created a redirect, it will launch whatever executable we have stored asC:\arbitrary_dir\system32\wermgr.exe
Mitigation
Microsoft released a patch for this vulnerability, so the first suggestion is to patch. Alternatively and additionally, because this vulnerability requires an executable file named wermgr.exe
and a report named Report.wer
, a host-based protection might be simply to ensure that any file named wermgr.exeoutside the legitimate
%WINDIR%\system32directory flagged and quarantined. The same tactic could be applied to the
Report.werfiles outside the proper structure. Another option might be to prevent symbolic link calls with
system32` as a directory destination.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 21h2,
- windows 10 22h2,
- windows 11 21h2,
- windows 11 22h2,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016 -,
- windows server 2019 -,
- windows server 2022 -
Exploited in the Wild
- Vendor Advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874)
- Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- Other: CISA Gov Alert (https://www.cisa.gov/news-events/alerts/2023/07/11/cisa-adds-five-known-vulnerabilities-catalog)
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: