High
CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability
CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability
Description
CVE-2021-1647 is a zero-day remote code execution vulnerability in the Malware Protection Engine component (mpengine.dll) of Microsoft’s Defender anti-virus product. It was published as part of the January 2021 Patch Tuesday release, along with a disclosure from Microsoft acknowledging that the vulnerability had been exploited in the wild. More information: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647
Add Assessment
Technical Analysis
No useful information has been published so far and most of the speculations found online are based on the CVSS 3.0 metrics found in the advisory. That said, the attack vector seems to be Local but can be exploited remotely, which means that some kind of malicious file needs to be placed locally to be scanned by Windows Defender and trigger the vulnerability. After talking about this with @smcintyre-r7 and @bwatters-r7, we can imagine that Remote means this file needs to be sent remotely somehow, for example, using a file upload in a website or an email attachment via Exchange.
Some considerations to keep in mind: Windows defender vulnerabilities get patched immediately and automatically, without user interactions. So, the exploitation window is very short. Finally, even if the exploitation succeeds, the evasion will be problematic, since the anti-virus will probably detect the attack.
Technical Analysis
This PoC [https://www.youtube.com/watch?v=FlaYEnckGxU] suggests that simply scanning a file is enough to cause code execution as system. There are many ways files get scanned by Defender, the default AV for Windows. Any unpatched system where a user even downloads a file (from email or the web) could be exploited. This makes the vulnerability very valuable to attackers, and the short time for a PoC to be released (in the wild exploits exist) makes me believe that weaponization is not overly difficult.
CVSS V3 Severity and Metrics
General Information
Vendors
- Microsoft
Products
- Microsoft System Center,
- Microsoft Security Essentials,
- Windows Defender on Windows 10 Version 1803 for 32-bit Systems,
- Windows Defender on Windows 10 Version 1803 for x64-based Systems,
- Windows Defender on Windows 10 Version 1803 for ARM64-based Systems,
- Windows Defender on Windows 10 Version 1809 for 32-bit Systems,
- Windows Defender on Windows 10 Version 1809 for x64-based Systems,
- Windows Defender on Windows 10 Version 1809 for ARM64-based Systems,
- Windows Defender on Windows Server 2019,
- Windows Defender on Windows Server 2019 (Server Core installation),
- Windows Defender on Windows 10 Version 1909 for 32-bit Systems,
- Windows Defender on Windows 10 Version 1909 for x64-based Systems,
- Windows Defender on Windows 10 Version 1909 for ARM64-based Systems,
- Windows Defender on Windows Server, version 1909 (Server Core installation),
- Windows Defender on Windows 10 Version 2004 for 32-bit Systems,
- Windows Defender on Windows 10 Version 2004 for ARM64-based Systems,
- Windows Defender on Windows 10 Version 2004 for x64-based Systems,
- Windows Defender on Windows Server, version 2004 (Server Core installation),
- Windows Defender on Windows 10 Version 20H2 for x64-based Systems,
- Windows Defender on Windows 10 Version 20H2 for 32-bit Systems,
- Windows Defender on Windows 10 Version 20H2 for ARM64-based Systems,
- Windows Defender on Windows Server, version 20H2 (Server Core Installation),
- Windows Defender on Windows 10 for 32-bit Systems,
- Windows Defender on Windows 10 for x64-based Systems,
- Windows Defender on Windows 10 Version 1607 for 32-bit Systems,
- Windows Defender on Windows 10 Version 1607 for x64-based Systems,
- Windows Defender on Windows Server 2016,
- Windows Defender on Windows Server 2016 (Server Core installation),
- Windows Defender on Windows 7 for 32-bit Systems,
- Windows Defender on Windows 7 for x64-based Systems,
- Windows Defender on Windows 8.1 for 32-bit systems,
- Windows Defender on Windows 8.1 for x64-based systems,
- Windows Defender on Windows RT 8.1,
- Windows Defender on Windows Server 2008 for 32-bit Systems,
- Windows Defender on Windows Server 2008 for 32-bit Systems (Server Core installation),
- Windows Defender on Windows Server 2008 R2 for x64-based Systems,
- Windows Defender on Windows Server 2008 R2 for x64-based Systems (Server Core installation),
- Windows Defender on Windows Server 2012,
- Windows Defender on Windows Server 2012 (Server Core installation),
- Windows Defender on Windows Server 2012 R2,
- Windows Defender on Windows Server 2012 R2 (Server Core installation)
There is a PoC (video only) now: https://www.youtube.com/watch?v=FlaYEnckGxU
I think this is much more valuable than you rated it for attackers. Any file that a user opens on a vulnerable machine is code execution as system. Very easy to extrapolate the phishing or even watering hole potential for this to be used.
@nonstate-actor Hey thanks for the comment, it’s appreciated! I think the idea behind the initial rating (which is subjective, and all users can give their own ratings by adding their own assessment, so feel free to do that too!) was that the software auto-updates immediately and there may not even be a way for users to disable the auto-update functionality. So the shelf life of the vuln is so short that it’s probably already over. Interested to hear more, though, please do consider adding an assessment! Those different opinions are super valuable.