IS specialist has published a PoC exploit for the SIGRed vulnerability

Valentina Palmiotti, a leading information security specialist at Grapl, published a PoC exploit for SIGRed vulnerability, and also presented a detailed report on its work.

Last year, Check Point experts discovered a critical vulnerability in Windows DNS Server, codenamed SigRed. It received an identifier CVE-2020-1350.

The vulnerability scored 10 out of 10 points on the CVSSv3 vulnerability rating scale. This rating means that the bug is extremely easy to use and requires almost no technical knowledge to operate it. Also, the vulnerability can be used for automated remote attacks and does not require prior authentication.

Since the bug has existed in the code for 17 years, the problem was dangerous for all versions of Windows Server released from 2003 to 2019. To exploit the bug, a hacker could send malicious DNS queries to Windows DNS servers, which entailed the execution of arbitrary code and could lead to the compromise of the entire infrastructure.

The root of the problem is how the Windows DNS server parses incoming DNS requests, as well as how it handles forwarded DNS requests. In particular, sending a response with a SIG greater than 64KB can trigger a controlled heap buffer overflow, execute malicious code, and ultimately allow a hacker to take control of the server.said the specialists of the Check Point company.

The vulnerability was fixed last year as part of the July “Patch Tuesday”.

Now Grapl Lead Information Security Officer Valentina Palmiotti has presented a PoC exploit for SIGRed and also published a detailed report on its work, where she also explains how to create SIEM rules to detect SIGRed exploitation.

If used carefully, attackers can remotely execute code on a vulnerable system and gain domain administrator rights, endangering the entire corporate infrastructure. the expert wrote in the report.

The Palmiotti exploit was successfully tested (1, 2) on unpatched 64-bit versions of Windows Server 2019, 2016, 2012R2, and 2012. A video demonstration of the attack can be seen below.