^{CVE-2020-16886:}Security Feature Bypass in PowerShellGet V2 Module

Overview

CVE-2020-16886 affects the PowerShellGet V2 module, which is used for installing and managing PowerShell modules. The vulnerability allows an attacker with administrator privileges to bypass Windows Defender Application Control (WDAC) policy restrictions. To exploit this vulnerability, an attacker would need to create a configuration that includes installing the PowerShellGet V2 module from the PowerShell Gallery onto a machine with WDAC configured to allow the module to run. Once this is done, PowerShell script can be injected and executed with full trust, enabling arbitrary code execution on the affected system. This vulnerability specifically relates to how the module processes URLs, which could be manipulated to bypass security controls.

Remediation

To address this vulnerability, Microsoft has released a security update that changes how URLs are processed in the PowerShellGet V2 module. Users should:

1. Apply the latest Microsoft security updates through Windows Update
2. Ensure PowerShellGet module is updated to the latest version
3. Review WDAC policies to ensure they are properly configured
4. Monitor for suspicious PowerShell activity, especially in environments where PowerShellGet is used
5. Consider implementing additional security controls such as PowerShell logging and constrained language mode where appropriate

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16886
2. Microsoft Security Response Center: https://msrc.microsoft.com/
3. PowerShellGet documentation: https://docs.microsoft.com/en-us/powershell/module/powershellget/
4. Windows Defender Application Control documentation: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control