CVE-2020-0753

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka ‘Windows Error Reporting Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0754.

Recent assessments:

tekwizz123 at February 23, 2020 6:25pm UTC reported:

A technical writeup for this bug was published today and is available at <https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754/blob/master/WERReport-CVE-2020-0753/POC.md&gt; along with a working PoC. The vulnerability itself exists within CWerService::SvcMergeETWLogs within Wersvc.dll according to the writeup.

From what I can see in the writeup the bug is a race condition which is relatively difficult to exploit, however because it is within the Windows Error Reporting Service it should be available by default on most Windows systems. Successful exploitation will result in arbitrary file deletion as the SYSTEM user.

Rated this as medium on exploitation as whilst it is a race condition, the fact that one is able to gain a 4-5 second window to exploit the bug by taking advantage of how the GetTempFileNameW() operation works. for generating the temp file name. Basically by prepopulating a directory with all file names from WER0000.tmp to WERFFFE.tmp (aka 0000 to FFFE), one forces GetTempFileNameW() to generate a file with the name WERFFFF.tmp.

Then following steps are executed (taken from writeup):

Then , I put all the WER***.tmp in \(pwd\1, and junction \)pwd\2\ –> $pwd\1;

we create a process to continuously trigger this function with the path \(pwd\2\. and create the other process to continuously execute the command SetOplock \)pwd\1\WERFFFF.tmp;

Once the Oplock is triggered , we junction \(pwd\2\ -> \RPC CONTROL, and then create object symbolic \RPC CONTROL\WERFFFF.tmp -> \)target and \RPC CONTROL\WERFFFF.tmp.etl –> $target

Release the oplock , the target file will be deleted with system privilege

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 3