Introduction of Topic
Sysmon is a popular Windows system monitoring tool that can be used to collect a variety of event data, including process creation, network activity, and file changes. However, a new vulnerability in Sysmon, CVE-2023-29343, could allow an attacker to elevate their privileges on a system.
Where Does the Vulnerability Exists
The vulnerability exists in versions of Sysmon prior to version 14.16. It is caused by a flaw in the way that Sysmon handles directory permissions. Specifically, if a directory is already owned by SYSTEM but grants full access—or at least WRITE_DAC, DELETE, and FILE_WRITE_ATTRIBUTES—to a low-privilege user or any group such a user might belong to, an attacker could exploit this vulnerability to create a new file in the directory with SYSTEM permissions. This would allow the attacker to execute arbitrary code with SYSTEM privileges.
Initial Access:
The initial access method for this vulnerability involves the identification of a directory already owned by SYSTEM but granting full access—or at least WRITE_DAC, DELETE, and FILE_WRITE_ATTRIBUTES—to a low-privilege user or any group such a user might belong to. This could be done by searching for directories that are owned by SYSTEM and have the appropriate permissions. Once a suitable directory has been found, the attacker could create a new file in the directory with SYSTEM permissions. This would allow the attacker to execute arbitrary code with SYSTEM privileges.
Microsoft has released Sysmon version 14.16 to address this vulnerability. Users should upgrade to this version as soon as possible to mitigate the risk of exploitation.
Are you affected by this vulnerability?
To determine if you are affected by this vulnerability, you can check the version of Sysmon that you are running. If you are running a version of Sysmon prior to 14.16, you are affected by this vulnerability.
What is the fix?
The fix for this vulnerability is to upgrade to Sysmon version 14.16. You can download Sysmon version 14.16 from the Sysinternals website.
How to mitigate the risk of exploitation
- Ensure that only authorized users have access to directories that are owned by SYSTEM.
- Limit the permissions that users have on directories that are owned by SYSTEM.
- Monitor your systems for signs of malicious activity.
