January 2024 Windows Updates brought a patch for CVE-2024-21320, a privilege escalation vulnerability in Windows. The vulnerability allows a remote attacker to acquire user's NTLM credentials when the victim simply downloads a Theme file or views such file in a network folder.
Security researcher Tomer Peled of Akamai discovered this issue, reported it to Microsoft, and later published a detailed article along with a proof of concept. These allowed us to reproduce the issue and create a micropatch for users of legacy Windows systems, which are no longer receiving security updates from Microsoft.
The Vulnerability
In short, the Theme file format allows a .theme file to specify two images, BrandImage and Wallpaper, which can also be on a remote network share and which Windows Explorer will automatically try to load when a Theme file is downloaded or displayed in a folder. A malicious Theme file could have these images point to a shared folder on attacker's computer, where user's NTLM credentials would be harvested and used for impersonating the user.
Note that Theme files are already generally considered "dangerous", and you cannot, for example, receive one as an email attachment through Outlook any more than you cannot receive an attached EXE file. This is for a good reason: a Theme file can specify a malicious screen saver, which is essentially an EXE file, so double-clicking such Theme file would be effectively as dangerous as double-clicking a malicious EXE. The vulnerability at hand, in contrast, is about simply downloading or viewing a Theme file in a folder, which is a much easier thing for an attacker to achieve than getting the user to actually apply a malicious theme.
Microsoft's Patch
As Tomer notes in their article, Microsoft patched this bug by implementing a registry value called DisableThumbnailOnNetworkFolder, which controls a security check for both image paths by calling PathIsUNC. In case DisableThumbnailOnNetworkFolder is 1 and PathIsUNC returns true, images are not loaded if located on a shared folder.
Our Micropatch
Our patch is logically identical to Microsoft's, only that the decision to block images on network path is hard-coded and not configurable via the registry. The patch consists of two small patchlets located in ThumbnailLoadImage and CFileSource::s_LoadPIDLFromPath functions of themeui.dll, both calling PathIsUNC and preventing the image from loading if its path is on a network share.
;XX-1641
MODULE_PATH "..\AffectedModules\themeui.dll_6.1.7601.24260_Win7_32-bit_uNoESU\themeui.dll"
PATCH_ID 1718
PATCH_FORMAT_VER 2
VULN_ID 7812
PLATFORM win32
patchlet_start
PATCHLET_ID 1
PATCHLET_TYPE 2
PATCHLET_OFFSET 0xbb90
N_ORIGINALBYTES 5
JUMPOVERBYTES 0
PIT shlwapi.dll!PathIsUNCW,themeui.dll!0xbc00
code_start
push dword[ebp+0x8] ;push patch string pointer as first arg
call PIT_PathIsUNCW ;call PathIsUNCW to check if the string from
;the theme file is a UNC path
cmp eax, 0x0 ;check if the function returned TRUE or FALSE
jne PIT_0xbc00 ;if TRUE, jump to an error block
code_end
patchlet_end
patchlet_start
PATCHLET_ID 2
PATCHLET_TYPE 2
PATCHLET_OFFSET 0x4bb7
N_ORIGINALBYTES 5
JUMPOVERBYTES 0
PIT shlwapi.dll!PathIsUNCW,themeui.dll!0x4c26
code_start
push dword[ebp-0x294] ;push patch string pointer as first arg
call PIT_PathIsUNCW ;call PathIsUNCW to check if the string from
;the theme file is a UNC path
cmp eax, 0x0 ;check if the function returned TRUE or FALSE
jne PIT_0x4c26 ;if TRUE, jump to an error block
code_end
patchlet_end
It is worth noting that neither Microsoft's nor our patch prevents the remote loading of these images in case the user actually opens a Theme file (e.g., by double-clicking on it) in order to apply the theme. While Windows do show a Mark-of-the-Web warning in such case for Theme files originating from the Internet, it would make little sense to add code for preventing NTLM leaks there because a malicious Theme file would probably install a malicious screen saver instead of just leak user's credentials.
Let's see our micropatch in action.
The attacker's computer on the right side of the video is waiting to collect user's NTLM credentials. A Windows user on the left opens the Downloads folder where a malicious Theme file was previously automatically downloaded while they visited attacker's web site. With 0patch disabled, just viewing the Theme file in the Downloads folder results in Windows Explorer trying to load the two images from attacker's computer, resulting in their NTLM credentials being captured there.
With 0patch enabled, viewing a Theme file no longer results in leaking user's NTLM credentials.
Micropatch Availability
Micropatches were written for the following security-adopted versions of Windows with all available Windows Updates installed:
- Windows 11 v21H1 - fully updated
- Windows 10 v20H2 - fully updated
- Windows 10 v2004 - fully updated
- Windows 10 v1909 - fully updated
- Windows 10 v1809 - fully updated
- Windows 10 v1803 - fully updated
- Windows 7 - no ESU, ESU 1 to 3
- Windows Server 2012 - fully updated
- Windows Server 2012 R2 - fully updated
- Windows Server 2008 - no ESU, ESU 1 to 3
Vulnerabilities like this one get discovered on a regular basis, and
attackers know about them all. If you're using Windows that aren't
receiving official security updates anymore, 0patch will make sure these
vulnerabilities won't be exploited on your computers - and you won't
even have to know or care about these things.
If you're new to 0patch, create a free account in 0patch Central, then install and register 0patch Agent from 0patch.com, and email sales@0patch.com for a trial. Everything else will happen automatically. No computer reboot will be needed.
We would like to thank Tomer Peled of Akamai for sharing their analysis, which made it possible for us to create a
micropatch for this issue.
No comments:
Post a Comment