Zero-Day Exploit Code Released for Windows Task Scheduler Flaw (CVE-2024-49039), Actively Exploited by RomCom Group
A proof-of-concept (PoC) exploit code for CVE-2024-49039, a zero-day vulnerability in Windows Task Scheduler, has been publicly released, raising concerns about increased attacks. This vulnerability, with a CVSS score of 8.8, allows attackers to escalate privileges and execute code at a higher integrity level.
Vulnerability Details:
CVE-2024-49039 enables attackers to bypass security restrictions and execute arbitrary code with elevated privileges. This flaw resides in the Windows Task Scheduler service, a critical component responsible for scheduling and automating tasks. By exploiting this vulnerability, attackers can gain a foothold in the system and potentially take complete control.
Exploitation in the Wild:
The RomCom cybercrime group, known for its sophisticated attacks, has been observed actively exploiting this zero-day vulnerability in recent campaigns targeting Firefox and Tor Browser users across Europe and North America. These attacks involve chaining CVE-2024-49039 with another zero-day (CVE-2024-9680) in Firefox to achieve code execution outside the browser’s sandbox.
Technical Analysis:
The vulnerability likely stems from a flaw in the WPTaskScheduler.dll component, which is integral to Task Scheduler since Windows 10 version 1507. Analysis suggests that this vulnerability allows attackers to bypass security measures like Restricted Token Sandbox and child-process restrictions, effectively elevating their privileges to a Medium Integrity level.
PoC Availability and Impact:
The release of PoC code on Github further amplifies the risk, as it provides malicious actors with a readily available tool to exploit CVE-2024-49039. This situation necessitates immediate action from users and organizations to mitigate potential threats.
Mitigation:
Microsoft addressed this vulnerability with a security update released on November 12th. Users are strongly urged to apply this update as soon as possible to protect their systems. Additionally, maintaining updated software and exercising caution when opening suspicious emails or clicking on unknown links can help prevent falling victim to such attacks.
