Microsoft Intune, Version 1.55.48.0 Advisory

Summary

The following document describes identified vulnerabilities in the Microsoft Intune application, version 1.55.48.0.

Product Vendor

Microsoft

Product Description

Microsoft Intune is an endpoint-management suite. The project’s official website is https://partner.microsoft.com/....

Vulnerabilities List

One vulnerability was identified within the Windows Task Scheduler application:

• Unquoted search path

The vulnerability is described in the following sections.

Affected Version

Version 1.55.48.0

Summary of Findings

At least one function in Microsoft Intune calls an external executable on a recurring basis without quoting the full path to the executable.

Impact

If a local user has write access to the root of the C:\ drive or the C:\Program Files (x86) directory, they may be able to execute programs as another user, resulting in horizontal or vertical privilege escalation.

Solution

There is no update available to address this vulnerability. Security defenders can monitor for the presence of files with paths such as C:\Program.exe and C:\Program Files (x86)\Microsoft.exe as indicators of potential compromise.

Vulnerabilities

Unquoted Search Path

The Microsoft Intune Management Extension does not quote one or more calls to the following utility program:

C:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe

An attacker with write access to the root of the C:\ drive or the C:\Program Files (x86) directory could execute code in the context of another user by creating a malicious executable named C:\Program.exe or C:\Program Files (x86)\Microsoft.exe, and then wait for Intune to call the agentexecutor.exe utility program. In the default Windows configuration, only local administrators have write access to the affected locations, but a malicious administrator could exploit the issue to move laterally into the accounts of other users who logged on to the same system. Additionally, a malicious user could exploit the issue to prevent execution of PowerShell scripts assigned by the Intune administrator for their organization.

Vulnerability Details

Vulnerability Type: Unquoted search path

Access Vector: ☐ Remote, ☒ Local, ☐ Physical, ☐ Context dependent, ☐ Other (if other, please specify)

Impact: ☐ Code execution, ☐ Denial of service, ☒☐ Escalation of privileges, ☐ Information disclosure, ☐ Other (if other, please specify)

Security Risk: ☐ Critical, ☐ High, ☐ Medium, ☒☐ Low

Vulnerability: CWE- 428

The presence of the vulnerability was confirmed by copying C:\Windows\SysWOW64\cmd.exe to C:\Program.exe, then waiting for Intune to execute PowerShell scripts. For example, the following list was present in Task Manager after leaving a laptop locked but powered on overnight:

FIGURE 1 - Task Manager entries for the Program.exe process

A custom 32-bit x86 executable that logged environmental data was created, and a copy was named C:\Program.exe. When executed via the unquoted search path, the following details were logged:

Date/time: 2022-07-06.14:00:20
Process ID: 23620
Parent Process ID: 23620
Parent Process Executable: Microsoft.Management.Services.IntuneWindowsAgent.exe

Arguments:
C:\Program
Files
(x86)\Microsoft
Intune
Management
Extension\agentexecutor.exe
-proxy
TXXX-PF2X5Q1N\blincoln
https://fef.msua06.manage.microsoft.com/TrafficGateway/TrafficRoutingService/SideCar/StatelessSideCarGatewayService

Environment variables:
…omitted for brevity…
LOCALAPPDATA=C:\Windows\system32\config\systemprofile\AppData\Local
…omitted for brevity…
USERNAME=TXXX-PF2X5Q1N$
USERPROFILE=C:\Windows\system32\config\systemprofile

FIGURE 2 - Relevant details logged by custom executable

These details indicated that the process that launched the unquoted command was the Intune Windows Agent, and that it executed in the context of the computer account. However, Task Manager showed the owning user was instead the currently logged-on user, indicating that Intune potentially used the elevated permissions of the computer account to change the context of the process after launching it. An attacker could therefore potentially exploit this vulnerability to not only execute commands as the computer account, but also as any user who logged on to the device.

The following Intune .NET DLL was decompiled to disclose at least two potential locations for this issue: Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.dll

The first instance of an unquoted search path was found in the source code file Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon\Services\IntuneWindowsAgent\AgentCommon\ProxyHelper.cs, as shown below:

string str1 = string.Format((IFormatProvider) CultureInfo.InvariantCulture, "{0}\\{1}", (object) Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), (object) "agentexecutor.exe");
…omitted for brevity…
string str4 = string.Format((IFormatProvider) CultureInfo.InvariantCulture, "{0} {1} {2} {3}", (object) str1, (object) " -proxy ", (object) str2, (object) str3);
Log.TraceInformation(str4);
Log.TraceInformation("[Proxy Poller] Launch agent executor in user session");
if (!NativeMethods.CreateProcessAsUser(tokenHandle, (string) null, str4, ref structure, ref structure, true, dwCreationFlags, IntPtr.Zero, (string) null, ref lpStartupInfo, out lpProcessInformation))

FIGURE 3 - Vulnerable code in ProxyHelper.cs

The decompiled code called the string.Format function to concatenate the path to the directory containing the DLL (C:\Program Files (x86)\Microsoft Intune Management Extension by default) with the string agentexecutor.exe. That path was then concatenated into a larger string that represented the full command line to call the agentexecutor.exe utility and pass it certain options. However, the path to agentexecutor.exe was not enclosed in quotation marks.

In contrast, the decompiled source code file Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon\Services\IntuneWindowsAgent\AgentCommon\ScriptWorker.cs contained code that correctly quoted search paths, as shown below:

string str6 = string.Format((IFormatProvider) CultureInfo.InvariantCulture, "{0}\\{1}", (object) Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), (object) "agentexecutor.exe");
…omitted for brevity…
string str7 = string.Format((IFormatProvider) CultureInfo.InvariantCulture, "\"{0}\" {1} \"{2}\" \"{3}\" \"{4}\" \"{5}\" {6} \"{7}\" {8} \"{9}\" {10} \"{11}\"", (object) str6, (object) " -remediationScript ", (object) str1, (object) str2, (object) str3, (object) str4, (object) timeOutSeconds, (object) pathFromRegistry, enforceSignatureCheck ? (object) "1" : (object) "0", (object) str5, (object) (runningMode != 1), (object) scriptParamRunString);
…omitted for brevity…
if (userContext)
{
…omitted for brevity…
Log.TraceInformation("Launch powershell executor in user session");
flag2 = NativeMethods.CreateProcessAsUser(userToken, (string) null, str7, ref structure, ref structure, true, dwCreationFlags, lpEnvironment, (string) null, ref lpStartupInfo, out lpProcessInformation);
}
else
{
Log.TraceInformation("Launch powershell executor in machine session");
flag2 = NativeMethods.CreateProcess((string) null, str7, IntPtr.Zero, IntPtr.Zero, true, (uint) dwCreationFlags, IntPtr.Zero, (string) null, ref lpStartupInfo, out lpProcessInformation);

FIGURE 4 - Correctly quoted process path in ScriptWorker.cs 

The code shown above was similar to the vulnerable code in ProxyHelper.cs, but the second call to string.Format wrapped the executable path in quotation marks, removing the potential for an unquoted search path vulnerability. An exhaustive audit of the Intune Management Extension was not conducted, and the same issue may be present elsewhere in the product.

Credits

• Ben Lincoln, Managing Senior Security Consultant II, Bishop Fox ([email protected])
  

Timeline

• 07/06/2022: Initial discovery
• 08/03/2022: Contact with vendor, ID VULN-071398 assigned
• 08/10/2022: Vendor assigned case number 73717
• 09/06/2022: Vendor acknowledged vulnerabilities
• 10/21/2022: Bishop Fox requests status update from Vendor via the MSRC Researcher Portal
• 10/24/2022: Bishop Fox requests status update from Vendor via email
• 10/26/2022: Vendor indicates that the vulnerability does not meet their criteria for servicing and will not be addressed
• 04/04/2023: Vulnerabilities publicly disclosed