A vulnerability in the Windows Installer component, which Microsoft attempted to fix several times to no avail, today received a micropatch to deny hackers the option of gaining the highest privileges on a compromised system.
The issue affects Windows 7 through 10. Microsoft’s most recent effort to address the issue (CVE-2020-16902) was in October. A bypass, complete with proof-of-concept (PoC) exploit code emerged in late December 2020.
Patch, bypass, repeat
During the installation of an MSI package, Windows Installer creates a rollback script via ‘msiexec.exe’ to revert any changes if anything goes wrong in the process.
A hacker with local privileges could run an executable with SYSTEM permissions if they could replace the rollback script with one that changes a registry value to point to their payload.
The vulnerability popped on Microsoft’s radar and received a fix in April 2019 (CVE-2019-0841). Vulnerability researcher Sandbox Escaper found a bypass by the end of May and published some technical details.
The story repeated four more times (CVE-2019-1415, CVE-2020-1302, CVE-2020-0814, CVE-2020-16902), and Windows Installer is still exploitable for privilege escalation to the highest permissions on a compromised machine.
Mitja Kolsek, CEO of ACROS Security and co-founder of the 0patch micropatching service, explains how Naceri’s PoC for the vulnerability (no tracking number) works:
“The proof-of-concept is using a rollback script that changes the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Fax\ImagePath to c:\Windows\temp\asmae.exe, which results in the Fax Service using attacker’s asmae.exe when the service is launched. This service was used because any user is allowed to launch it, and it’s running as Local System” – Mitja Kolsek
Until Microsoft comes up with a permanent patch, a temporary one is available through the 0Patch platform. It is a single-instruction fix that does not require a reboot of the system.
The video below shows that the micropatch prevents a local non-admin user from modifying a registry value that points to the Fax Service executable, which would lead to running attacker code.
The temporary, free fix from 0Patch works for the following systems:
Windows 10 v20H2, 32/64bit, updated with January 2021 updates
Windows 10 v2004, 32/64bit, updated with January 2021 updates
Windows 10 v1909, 32/64bit, updated with January 2021 updates
Windows 7, 32/64bit, with ESU, updated with January 2021 updates
Windows 7, 32/64bit, without ESU, updated with January 2020 updates
