Microsoft Windows REG File Filename Message authentication spoofing ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows. Affected by this issue is some unknown functionality of the component REG File Handler. The manipulation of the argument Filename with the input Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg results in authentication spoofing (Message). The attack can be executed remotely. Additionally, an exploit exists. The existence of this vulnerability is still disputed at present.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft Windows (Operating System) (affected version not known). Affected is some unknown functionality of the component REG File Handler. The manipulation of the argument Filename with the input value Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg leads to a authentication spoofing vulnerability (Message). CWE is classifying the issue as CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 03/10/2019 by John Page (hyp3rlinx) as not defined advisory (Website). The advisory is shared for download at hyp3rlinx.altervista.org. The public release was coordinated with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. The advisory points out:

Normally when a user opens a .reg file UAC will launch (if user is run as Admin) if targeting a non privleged user we can still hijack HKCU reg settings without having to deal with UAC. After they will get the registry security warning dialog box asking them if they "trust the source" and "Are you sure you want to continue?" etc and will also have a choice of either 'Yes' or 'No' to select from. However, we can inject our own messages thru the filename to direct the user to wrongly click "Yes", as the expected "Are you sure you want to continue?" dialog box message is under our control. The registry dialog echoes back the filename plus any text we add and allows us to terminate part of its default security warning message. We achieve this using % encoded characters in the filename like %n or %r and %0.

A public exploit has been developed by John Page (hyp3rlinx) in REG File and been published immediately after the advisory. The exploit is shared for download at hyp3rlinx.altervista.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $5k-$25k. The real existence of this vulnerability is still doubted at the moment. The code used by the exploit is:

Microsoft-Security-Update-v1.2-Windows-10.r%e%g%r%nC%l%i%c%k%b%Y%e%s%b%b%b%1%0.reg

Example, the "do not add it to the registry" and "Are you sure you want to continue?" default warning messages can be done away with using %0.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-131619. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #49: Microsoft Windows .Reg File Dialog Box Message Spoofing 0day (by hyp3rlinx)

Duplicate

• Submit #XXXXX: Xxxxxxx .xxx Xxxx Xxxxxx Xxxxx - Xxxxxxxxxx Xxxxxx (by hyp3rlinx)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion