SecBoard
Zurück zur CVE-Übersicht

CVE-2021-36952

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score35/100 — MITTEL
  • CVSS 7.8 — Hoch
  • EPSS 51%

EPSS-Score

51.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

SecBoard-Einordnung

CVE-2021-36952 beschreibt eine () Schwachstelle in Microsoft Visual Studio. Diese Sicherheitslücke ermöglicht es einem Angreifer, beliebigen Code auf einem betroffenen System auszuführen, was zu einer vollständigen Kompromittierung führen kann. Die Schwachstelle betrifft Visual Studio 2017 und Visual Studio 2019.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

Visual Studio Remote Code Execution Vulnerability

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection focuses on unusual process activity related to Visual Studio and DDS file parsing, specifically looking for child processes that indicate code execution.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "devenv.exe" or InitiatingProcessFileName =~ "msdev.exe" // Or other relevant Visual Studio processes
| where FileName in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe") or FileName endswith ".exe" and FolderPath contains "temp"
| where ProcessCommandLine contains ".dds"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine

Splunk SPL

index=your_index_name sourcetype=your_sourcetype_name (ParentProcessName="devenv.exe" OR ParentProcessName="msdev.exe") (ProcessName="cmd.exe" OR ProcessName="powershell.exe" OR ProcessName="pwsh.exe" OR ProcessName="wscript.exe" OR ProcessName="cscript.exe" OR ProcessName="mshta.exe" OR (ProcessName="*.exe" AND ProcessPath="*temp*")) CommandLine="*.dds*"

Sigma

title: Visual Studio DDS RCE Attempt
status: experimental
description: Detects potential remote code execution attempts via crafted DDS files opened in Visual Studio.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1076/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\devenv.exe'
      - '\msdev.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
    CommandLine|contains: '.dds'
  condition: selection
level: high

Elastic ES|QL

from process where
  (process.parent.executable.full_path : "*\\devenv.exe" or process.parent.executable.full_path : "*\\msdev.exe") and
  (process.executable.full_path : "*\\cmd.exe" or process.executable.full_path : "*\\powershell.exe" or process.executable.full_path : "*\\pwsh.exe" or process.executable.full_path : "*\\wscript.exe" or process.executable.full_path : "*\\cscript.exe" or process.executable.full_path : "*\\mshta.exe" or (process.executable.full_path : "*.exe" and process.executable.full_path : "*\\temp\\")) and
  process.args : "*.dds*"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*

Referenzen