Microsoft asks admins to patch PowerShell to fix Windows Defender Application Control (WDAC) bypass

guest · Oct 18, 2021

Microsoft asks admins to patch PowerShell to fix WDAC bypass
October 18, 2021
https://www.bleepingcomputer.com/ne...dmins-to-patch-powershell-to-fix-wdac-bypass/

Microsoft has asked system administrators to patch PowerShell 7 against two vulnerabilities allowing attackers to bypass Windows Defender Application Control (WDAC) enforcements and gain access to plain text credentials.

Redmond released PowerShell 7.0.8 and PowerShell 7.1.5 to address these security flaws in the PowerShell 7 and PowerShell 7.1 branches in September and October.
Click to expand...

Leaked passwords and WDAC bypass
WDAC is designed to protect Windows devices against potentially malicious software by ensuring that only trusted apps and drivers can run, thus blocking malware and unwanted software from launching.
When the software-based WDAC security layer is enabled in Windows, PowerShell automatically goes into constrained language mode, restricting access to only a limited set of Windows APIs.

By exploiting the Windows Defender Application Control security feature bypass vulnerability tracked as CVE-2020-0951, threat actors can circumvent WDAC's allowlist, which allows them to execute PowerShell commands that would otherwise be blocked when WDAC is enabled.

"To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code," Microsoft explains.
Click to expand...

The second flaw, tracked as CVE-2021-41355, is an information disclosure vulnerability in .NET Core where credentials could be leaked in clear text on devices running non-Windows platforms.

"An Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on non-Windows Operating systems," Microsoft said.
Click to expand...

NormanF · Oct 19, 2021

The fix is here and home users can patch the affected PS on Windows 11:

https://docs.microsoft.com/en-us/po...powershell-on-windows?view=powershell-7.1#msi

Just download and run the MSI to update PS to 7.15. Should be done ASAP.

Log in or Sign up

Microsoft asks admins to patch PowerShell to fix Windows Defender Application Control (WDAC) bypass

guest Guest

NormanF Registered Member

Log in or Sign up

Microsoft asks admins to patch PowerShell to fix Windows Defender Application Control (WDAC) bypass

guest Guest

NormanF Registered Member

Useful Searches