Recent research by SpecterOps has revealed a critical vulnerability within Windows Server Update Services (WSUS), a widely used patch management system in enterprises. This flaw allows attackers to potentially inject malicious updates into networks, thereby compromising endpoint security.
Understanding the WSUS Vulnerability
The vulnerability arises when enterprises host WSUS on an external SQL Server database. According to researcher Beyviel David, attackers who gain local network access can hijack authentication processes, capture database sessions, and deliver rogue updates that are automatically trusted and executed by domain-joined endpoints.
This exploitation vector is particularly pronounced in configurations where the update management server is separate from its storage, using a standalone SQL Server instead of the default Windows Internal Database. This separation, coupled with NTLM authentication coercion, creates a significant security risk.
Technical Exploitation of WSUS
Attackers utilize tools like PetitPotam to force the WSUS server to authenticate over SMB to a server under their control. This authentication is then relayed to the remote SQL Server database using Ntlmrelayx. The WSUS computer account’s permissions allow attackers to establish a session on the SUSDB instance without needing traditional domain credentials.
Once access is gained, attackers can leverage stored procedures such as spImportUpdate and spDeployUpdate to craft and deliver malicious updates. These updates are interpreted as legitimate by the network, passing internal validations due to the trust placed in the WSUS computer account.
Mitigating the Threat
To counteract this threat, enterprises must strengthen their update infrastructure. Key measures include enforcing Extended Protection for Authentication (EPA) on SQL servers hosting SUSDB to prevent NTLM relaying. Network segmentation is also crucial, allowing only authorized WSUS servers and management hosts to access the database.
Additionally, monitoring stored procedure calls for unusual activities involving files like .txt or .esd can help in early detection of attacks. Security teams are encouraged to use tools such as ludus_wsus and NotWSUSpicious, released by SpecterOps, to simulate and study vulnerabilities within controlled environments.
This research underscores the necessity for organizations to enhance their cybersecurity strategies, ensuring robust defenses against evolving threats to their network infrastructure.
