New Windows Zero-Day: LegacyHive Exploit Targets Patched Systems
Local privilege escalation flaw discovered in fully updated Windows environments.
1What is LegacyHive?
Discovered by researcher Chaotic Eclipse, LegacyHive is a local privilege escalation vulnerability in Windows User Profile Service. Attackers with standard user access can load another user's registry hive to elevate privileges. Microsoft has yet to release a patch, raising concerns among security professionals.
2Exploitation Mechanism
The attacker needs existing access to the target system and valid credentials. By loading another user's registry hive, protected data becomes accessible. This technique could be valuable for attackers already inside a network, though it requires multiple user accounts to execute.
3Limited Mass Exploit Potential
The requirement for multiple user accounts makes widespread internet exploitation challenging. However, it remains dangerous for post-compromise operations in enterprise networks. The researcher intentionally simplified the PoC to limit potential misuse.
4Ongoing Tension with Microsoft
Chaotic Eclipse has published multiple Windows zero-days without coordination in recent months, criticizing Microsoft's handling of security reports. Microsoft argues such disclosures unnecessarily endanger customers, while advocating for coordinated vulnerability disclosure processes.
5Previous Vulnerabilities
The researcher previously disclosed GreatXML (bypassing BitLocker), RoguePlanet (targeting Microsoft Defender), and other zero-days including BlueHammer, UnDefend, and RedSun. May's YellowKey and GreenPlasma vulnerabilities similarly targeted Microsoft products.
6Security Strategy Debate
Microsoft emphasizes the importance of Coordinated Vulnerability Disclosure (CVD), aiming to release patches before exploits reach attackers. However, some independent security experts argue companies aren't sufficiently transparent in these processes, fueling researcher frustrations.
Original article: Security Affairs — Windows Sistemlerinde Yeni Zero-Day Açığı: LegacyHive