Hackers Exploit Privilege Escalation Flaw on Windows Backup Service

Threat actors have been noticed exploiting a privilege escalation vulnerability on the Windows Backup and Restore provider.

“[…] CVE-2023-21752 is a vulnerability which permits a basic user to execute arbitrary code on a host to delete data files from [a] specified storage path, from Windows Backup and Restore assistance,” wrote security researchers at CloudSEK. “This motion is only doable by privileged people.”

Additional, the exploit could be leveraged for privilege escalation on a host from primary consumer to process user, thus enabling account takeovers.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“The vulnerability is activated using the Race Condition among short-term file generation and deletion, which usually takes spot next the authentication method,” the CloudSEK advisory reads.

“Windows hosts that follow irregular patch installations are subjected to risk, with risk actors possibly utilizing the exploit in the wild. The bare prerequisite is to have a nearby account on the targeted technique.”

The higher-severity vulnerability has a CVSS foundation rating of 7.1 and impacts Windows 7, 10 and 11 OS versions. It was patched by Microsoft in its initially Patch Tuesday of 2023. 0patch also introduced a unique fix for the flaw on January 31.

“Our micro patch is logically equivalent to Microsoft’s, but to lower its complexity and code dimension, we opted for a less difficult naming of the non permanent file,” wrote the security researchers. “This is to accommodate multiple backup procedures working with the very same route at the exact same time, which is unlikely but not extremely hard.”

Again to the CloudSEK advisory, the business mentioned it spotted risk hackers talking about the vulnerability in a Russian-talking cybercrime forum and on Telegram channels.

“A model new vulnerability was located on January 10 in the Windows Backup support,” reads a Telegram write-up noticed and shared by CloudSEK. “The vulnerability would make it straightforward to elevate privileges from the user level to [local privilege escalation].”

The company’s advisory comes times after Microsoft announced releasing patches for in excess of 70 CVEs this thirty day period, like a few zero-days.