CVE-2023-21752: Windows Backup Service Elevation of Privilege Vulnerability Discovered and Explained

A new vulnerability identified as CVE-2023-21752 has recently been discovered in the Windows Backup Service, which allows for potential elevation of privilege attacks. This type of attack allows a threat actor to gain elevated system privileges, potentially leading to unauthorized access and control of sensitive data or system resources. In this post, we will explore the details of the vulnerability, demonstrate an example using a code snippet, and present links to original references and additional information.

Background

The Windows Backup Service is responsible for backing up and restoring user data, system settings, and application settings. This process runs in the background and is generally initiated by the system administrator or triggered automatically through scheduling. The vulnerability in this service is an elevation of privilege vulnerability, which refers to the possibility of exploiting the Windows Backup Service to execute unauthorized commands on the target system with elevated privileges.

Exploit Details

This vulnerability is caused by a bug in the way the Windows Backup Service processes symbolic links. When a malicious actor creates a specially crafted symbolic link, it can trick the system into backing up or restoring files to an unintended location. Consequently, the attacker can overwrite critical system files, potentially leading to a complete compromise of the system.

Proof of Concept

The following proof of concept (PoC) demonstrates how this vulnerability can be exploited by creating a symbolic link:

# Import required libraries
import os
import sys

# Check whether the program is running with administrator privileges
if os.geteuid() != :
    print("[!] Please run this script with administrator privileges.")
    sys.exit()

# Create a malicious symbolic link
src = "C:\\Windows\\System32\\vulnerable.dll"
dst = "C:\\Users\\Public\\public_backup.dll"

try:
    os.symlink(src, dst)
    print("[+] Symbolic link created successfully.")
except FileExistsError:
    print("[!] Symbolic link already exists.")
except Exception as e:
    print("[!] Error creating symbolic link:", e)

Once the symbolic link is created, an attacker can use the Backup Service to overwrite the insecure file (vulnerable.dll in this case) with an arbitrary replacement, potentially gaining unauthorized access or control over the system.

It is important to note that this exploit requires the user to have administrator privileges in the first place. However, exploiting this vulnerability enables the attacker to execute with system-level privileges, which are higher than administrator privileges, enabling the potential for increased malicious activity or damage.

Mitigation and References

Microsoft has released a security update addressing this vulnerability, and it is strongly recommended that users and administrators apply the necessary patches immediately. Further information can be found in the Microsoft Security Advisory: MS-CVE-2023-21752 (https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2023-21752).

It is also essential to regularly update the operating system and other installed software and follow best practices in system administration to reduce the risk of unauthorized access and system compromise.

Conclusion

The CVE-2023-21752 vulnerability in the Windows Backup Service demonstrates the potential risk of exploiting the service to gain unauthorized access and control over a system. By staying informed about newly discovered vulnerabilities and applying necessary security updates, users and administrators can minimize the risk to their systems.

Timeline

Published on: 01/10/2023 22:15:00 UTC
Last modified on: 01/18/2023 20:17:00 UTC