Researcher Publishes New PoC for Windows Vulnerability Shortly After Patch Tuesday

A security researcher known by the alias Chaotic Eclipse (also Nightmare-Eclipse) has published a new proof-of-concept exploit called LegacyHive. The release came just a few hours after Microsoft rolled out its July Patch Tuesday update package.

The exploit is described as a privilege-escalation vulnerability involving the arbitrary loading of a registry hive in the Windows User Profile Service (also known as ProfSvc). This component is a core part of the operating system and is responsible for managing user accounts and their environments.

According to the author of the PoC, certain conditions must be met for the vulnerability to be exploited successfully, but the exact technical details of the attack mechanism are not disclosed in the original post.

The ProfSvc service has traditionally been considered a critically important Windows component, since it is involved in the process of a user logging into the system and initializing their profile. Vulnerabilities in system services of this kind are of heightened interest to attackers, because successful exploitation makes it possible to gain a higher level of privilege in the system than the attacker initially has access to.

The appearance of a public PoC shortly after official patches are released is a common practice in the security research community, but it also raises the risks for organizations that have not yet had time to deploy the updates. Information security specialists are advised to promptly familiarize themselves with the details of the vulnerability and assess the need for additional protective measures until the corresponding fixes are installed.

Microsoft has not yet commented on the publication of this PoC.

Source: The Hacker News