A critical flaw in Credential Security Support Provider protocol (CredSSP) affects all versions of Windows

Security experts at firm Preempt Security discovered a critical vulnerability in Credential Security Support Provider protocol (CredSSP) that affects all versions of Windows to date.

The flaw, tracked as CVE-2018-0886, could be used by a remote attacker to exploit RDP (Remote Desktop Protocol) and Windows Remote Management (WinRM) to steal data and run malicious code.

The vulnerability is a logical cryptographic issue in CredSSP that can be exploited by an attacker in a man-in-the-middle position to steal session authentication data and perform a Remote Procedure Call attack.

An attacker with WiFi/Physical access to your network could easily launch a man-in-the-middle attack.

The CredSSP protocol enables an application to securely delegate a user’s credentials from a client to a target server, it works with both RDP and WinRM.

When a client and server authenticate over RDP and WinRM, a man-in-the-middle attacker can execute remote commands on the target system. The attacker waits for a CredSSP session to occur, then it will steal session authentication and perform a Remote Procedure Call (DCE/RPC) attack on the server that the user originally connected to.

“An attacker which have stolen a session from a user with sufficient privileges could run different commands with local admin privileges. This is especially critical in case of domain controllers, where most Remote Procedure Calls (DCE/RPC) are enabled by default,” explained Yaron Zinar, security experts for Preempt.