20-year-old unpatched high-severity vulnerability affecting all
versions of Microsoft Windows, back from Windows XP to the latest
Windows 10.
The vulnerability, which could allow a low privileged
application to read and write data to a higher privileged
application, resides in the way MSCTF clients and server
communicate with each other.
MSCTF is a module in Text Services Framework (TSF) of the
Windows operating system that manages things like input methods,
keyboard layouts, text processing, and speech recognition.
In a nutshell, when you log in to your Windows machine, it starts a
CTF monitor service that works as a central authority to handle
communications between all clients, which are actually windows for
each process running on the same session.
“You might have noticed the ctfmon service in task manager, it is
responsible for notifying applications about changes in keyboard
layout or input methods. The kernel forces applications to connect
to the ctfmon service when they start, and then exchange messages
with other clients and receive notifications from the service,” the
researcher explained.
since there is no access control or any kind of authentication in
place for this interaction, any application, any user and even
sandboxed processes can:
- connect to CTF session,
- read and write the text of any window, from any other
session, - fake their thread id, process id, and HWND,
- pretend as a CTF service, tricking other applications, even
privileged ones, to connect to it, or - escape from sandboxes and escalate privileges.
“There is no access control in CTF, so you could connect to another
user’s active session and take over any application, or wait for an
Administrator to login and compromise their session,” Ormandy
explains in a blog
post[2] published today.
“It turns out it was possible to reach across sessions and violate
NT security boundaries for nearly twenty years, and nobody
noticed.”
easily bypass User Interface Privilege Isolation (UIPI), letting
even an unprivileged process to:
- read sensitive text from any window of other applications,
including passwords out of dialog boxes, - gain SYSTEM privileges,
- take control of the UAC consent dialog,
- send commands to the administrator’s console session, or
- escape IL/AppContainer sandboxes by sending input to
unsandboxed windows.
Ormandy has also published a proof-of-concept video demonstrating
how the issue can be exploited to gain SYSTEM privileges in Windows
10.
Besides this, CTF protocol reportedly also contain many memory
corruption flaws that, according to the researcher, can be
exploited in a default configuration.
“Even without bugs, the CTF protocol allows applications to
exchange input and read each other’s content. However, there are a
lot of protocol bugs that allow taking complete control of almost
any other application. It will be interesting to see how Microsoft
decides to modernize the protocol,” Ormandy says.
Tool” on Github that he developed and used to discover many
critical security issues in the Windows CTF protocol.
Ormandy responsibly reported his findings to Microsoft in
mid-May this year and released the details to the public today
after Microsoft failed to address the issue within 90 days of being
notified.
References
- ^
discovered
(bugs.chromium.org) - ^
blog post
(googleprojectzero.blogspot.com) - ^
CTF Exploration Tool
(github.com)
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/62O3vpT_htc/ctfmon-windows-vulnerabilities.html