Hi everyone -heads up I'm in a new role working w/ @msftsecresponse supporting customers, the security researchers & bug bounty programs. Will still share news on product updates & detections but will pivot more 2 patches, vulns & exploits. Always listening on how we can improve
-
Like the vulnerability when profile picture is changed for example. It do setacl on file in user writeable directory- with mount points it can get redirected to file in system32. Looks immediately straight forward to exploit, but because of random filenames
it is pretty much impossible- the name must be known in advance to have a symlink redirect the file open. I spent time on making it exploitable- https://docs.google.com/document/d/1jNX2H6VtvMhVbtLQc_52njKAF1ocLkip6HuCI7WS4os/edit?usp=sharing … And submitted- but someone was before me, I suspect a POC was not provided- so easy to be faster.
-
-
By requiring POC there is also no false positives and priority evaluation for fix become based on actual difficulty in exploitation.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Bytheway- your patch was ineffective, got my exploit working again. Trying to avoid mount point attacks by keeping files locked is almost impossible, just impersonate.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.