CVE-2020-0951:Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability

splash
Back

Description Preview

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would normally be blocked by WDAC. This vulnerability requires an attacker to already have administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code, bypassing the intended security controls.

Overview

CVE-2020-0951 is a security feature bypass vulnerability affecting Windows Defender Application Control (WDAC), which is designed to control which applications and code can run on Windows systems. This vulnerability allows attackers with administrator privileges to bypass WDAC restrictions specifically for PowerShell commands. The vulnerability undermines the security controls that WDAC is meant to enforce, potentially allowing the execution of malicious PowerShell code that would otherwise be blocked. The risk is limited by the requirement that an attacker must already have administrator access to the affected system, but once this access is obtained, the security controls that would normally prevent certain types of code execution can be circumvented.

Remediation

Microsoft has released a security update that addresses this vulnerability by correcting how PowerShell commands are validated when WDAC protection is enabled. Organizations should:

  1. Apply the latest Microsoft security updates to all affected systems.
  2. Ensure that Windows Defender Application Control policies are properly configured after applying the update.
  3. Follow the principle of least privilege by limiting administrator access to systems.
  4. Monitor PowerShell activity on critical systems for suspicious commands.
  5. Consider implementing additional security controls such as advanced logging for PowerShell activities.

References

  1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0951
  2. Microsoft Security Response Center: https://msrc.microsoft.com/
  3. Windows Defender Application Control documentation: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Public Administration: Medium
    Public Administration
  3. Health Care & Social Assistance: Medium
    Health Care & Social Assistance
  4. Educational Services: Medium
    Educational Services
  5. Finance and Insurance: Medium
    Finance and Insurance
  6. Transportation & Warehousing: Medium
    Transportation & Warehousing
  7. Professional, Scientific, & Technical Services: Medium
    Professional, Scientific, & Technical Services
  8. Retail Trade: Medium
    Retail Trade
  9. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  10. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  11. Utilities: Low
    Utilities
  12. Information: Low
    Information
  13. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  14. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  15. Accommodation & Food Services: Low
    Accommodation & Food Services
  16. Mining: Low
    Mining
  17. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  18. Construction: Low
    Construction
  19. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background