TLDR Tech / Practical
Intune Portal Flaw Lets Users Gain SYSTEM Access
AmberWolf researchers have revealed that Microsoft Intune's self-service Company Portal can be exploited by regular users to achieve local privilege escalation to SYSTEM. This is possible by exploiting vulnerabilities in temporary directories associated with NSIS-packaged installers. The Intune Management Extension installs these packages as SYSTEM without properly securing the %TEMP% environment variable. This oversight allows attackers to potentially insert malicious DLLs through file operations or by overwhelming the temporary filename generation process. To assist security professionals, the researchers have released IMEClient, a separate utility that mimics the REST API and named pipe protocols, and includes a framework for identifying installer vulnerabilities.
Read the full story