4 ms·

"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified

"Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely. After our appeal, the issue was classified as "Critical, RCE", but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windows 11)" So they wrote a protocol-handler bound on every Win10 machine which arbitrarily runs a command if you can convince the user to click one message box.

edoceo 5y ago
And apparently Win11 too. Don't all protocol handlers invoke some execution? Like http goes to my browser (only Edge) and that other windows internal one which also goes to Edge (and resets my registered http handler)
- TonyTrapp 5y ago
  > Don't all protocol handlers invoke some execution? Sure, but you don't expect arbitrary code execution. The important distinction is whether the attacker can control what is executed. So if you click on a HTTPS link, you should be safe to assume that it opens a new browser tab, and not open a command prompt like in that example.
  - londons_explore 5y ago
    cmd://calc.exe Nobody said URL handlers should offer any security guarantees. There is no clear amount of things that a clicked URL should be able to do. In some circumstances, the full permissions of the logged in user would be appropriate. The security onus really ought to be on the application which sourced the URL - it knows where it came from.
    - TonyTrapp 5y ago
      The problem is twofold - the sourcing application should tell you which protocol handler is being invoked (this is where IE/Edge fails) - but the protocol handler itself should also not do anything unexpected. When you open a https:// https://.... link, you know it's not going to run a local application. Similarly, ms-officecmd:... should open some sort of Office application, and nothing else. I think that's the minimum of a security guarantee you can expect from any program.
snag 5y ago
> We discovered a drive-by code execution vulnerability on Windows 10 via IE11/Edge Legacy and MS Teams, triggered by an argument injection in the Windows 10/11 default handler for ms-officecmd: URI > Exploitation through other browsers requires the victim to accept an inconspicuous confirmation dialog. No confirmation needed with Windows 10 and IE11 or Edge Legacy
dtx1 5y ago
For everyone reading this, let me translate: > One of the largest IT Company on this planet, with software running on billions of devices, even in critical infrastructure, would like you to sell exploits to their programs to the open market instead of their bug bounty program.
onemoresoop 5y ago
Microsoft is teaching bounty seekers to look elsewhere and honestly that is a very stupid decision for such a deep pocketed company. It is only making their software less safe.

edoceo 5y ago

And apparently Win11 too. Don't all protocol handlers invoke some execution? Like http goes to my browser (only Edge) and that other windows internal one which also goes to Edge (and resets my registered http handler)

TonyTrapp 5y ago
> Don't all protocol handlers invoke some execution? Sure, but you don't expect arbitrary code execution. The important distinction is whether the attacker can control what is executed. So if you click on a HTTPS link, you should be safe to assume that it opens a new browser tab, and not open a command prompt like in that example.
- londons_explore 5y ago
  cmd://calc.exe Nobody said URL handlers should offer any security guarantees. There is no clear amount of things that a clicked URL should be able to do. In some circumstances, the full permissions of the logged in user would be appropriate. The security onus really ought to be on the application which sourced the URL - it knows where it came from.
  - TonyTrapp 5y ago
    The problem is twofold - the sourcing application should tell you which protocol handler is being invoked (this is where IE/Edge fails) - but the protocol handler itself should also not do anything unexpected. When you open a https:// https://.... link, you know it's not going to run a local application. Similarly, ms-officecmd:... should open some sort of Office application, and nothing else. I think that's the minimum of a security guarantee you can expect from any program.

snag 5y ago

> We discovered a drive-by code execution vulnerability on Windows 10 via IE11/Edge Legacy and MS Teams, triggered by an argument injection in the Windows 10/11 default handler for ms-officecmd: URI > Exploitation through other browsers requires the victim to accept an inconspicuous confirmation dialog. No confirmation needed with Windows 10 and IE11 or Edge Legacy

dtx1 5y ago

For everyone reading this, let me translate: > One of the largest IT Company on this planet, with software running on billions of devices, even in critical infrastructure, would like you to sell exploits to their programs to the open market instead of their bug bounty program.

onemoresoop 5y ago

Microsoft is teaching bounty seekers to look elsewhere and honestly that is a very stupid decision for such a deep pocketed company. It is only making their software less safe.