You can break the chain
Microsoft’s Attack Surface Analyzer (ASA) can be turned against the systems it is meant to protect using a sophisticated three-part attack, security researcher Parsia Hakimian has demonstrated.
Hakimian chained together three bugs to achieve remote code execution (RCE) on a system running ASA, a Windows system snapshot tool.
The proof-of-concept exploit he put together is somewhat ironic because Attack Surface Analyzer is designed to scan an OS to analyze changes an installed application has made (i.e. potential problems) rather than becoming a conduit for the attack itself.
Stage one of the attack depends on ASA’s use of Electron.NET, a tool for packaging web apps as desktop applications.
ASA is built on top of Electron.NET but a bug in the implementation means an attacker can use a targeted victim’s web browser to access ASA, the underlying application.
Stage three – and blast off – involves leveraging the XSS flaw to achieve RCE via NodeIntegration.
Hakimian reported the issue to Microsoft late last month. Redmond confirmed the problem and developed a fix, released earlier this month.
A full write-up of the three-stage attack can be found in a blog post by Hakimian.