On August 27th, an independent security researcher released a vulnerability in Windows Task Scheduler [1]. If exploited the vulnerability would allow a threat actor, with pre-established access to the system, to raise their privilege from user-mode privileges to full system privileges. At the time of writing this attack has not been seen in the wild, but Proof of Concept (PoC) code has been publicly released, increasing the likelihood that threat actors will quickly adapt and employ this attack. Windows 10 and Windows Server 2016 systems are vulnerable to this privilege escalation method. The vulnerability and PoC were publicly released without giving the vendor notice; as such security patches are not yet available.
What we’re doing about it
- esENDPOINT detects behavior relating to known exploitation attempts
- Current esRECON checks identify Task Scheduler related vulnerabilities and will be updated to assist in identifying this specific one
- eSentire Threat Intelligence is monitoring this topic for additional information
What you should do about it
- Apply security patches once they are made available by Microsoft
- Since publishing, Microsoft has released a security patch which should be applied after performing a business impact review. [2]
Additional information
The major concern relating to this vulnerability is that threat actors may incorporate it into their malware. This would greatly increase the potential damage attacks by giving threat actors a higher privilege level than otherwise possible.
The flaw stems from the Task Scheduler API function, SchRpcSetSecurity, which fails to check permissions. Any account can call it and set file permissions on anything on the system [3].
References:
[1] Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface Vulnerability Note VU#906424
https://www.kb.cert.org/vuls/id/906424
[2] CVE-2018-8440 | Windows ALPC Elevation of Privilege Vulnerability Security Vulnerability
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440
[3] Double Pulsar: Task Scheduler ALPC exploit high-level analysis – CVE-2018–8440
https://doublepulsar.com/task-scheduler-alpc-exploit-high-level-analysis-ff08cda6ad4f
