Microsoft warns of critical PowerShell 7 code execution vulnerability

[The_King]

Content source

https://www.bleepingcomputer.com/news/security/microsoft-warns-of-critical-powershell-7-code-execution-vulnerability/

Microsoft warns of a critical .NET Core remote code execution vulnerability in PowerShell 7 caused by how text encoding is performed in .NET 5 and .NET Core.

PowerShell provides a command-line shell, a framework, and a scripting language focused on automation for processing PowerShell cmdlets.

It runs on all major platforms, including Windows, Linux, and macOS, and it allows working with structured data such as JSON, CSV, and XML, as well as REST APIs and object models.

"Update as soon as possible"​

The company says no mitigation measures are available to block exploitation of the security flaw tracked as CVE-2021-26701.

Customers are urged to install the updated PowerShell 7.0.6 and 7.1.3 versions as soon as possible to protect their systems from potential attacks.

Microsoft's initial advisory also provides developers with guidance on updating their apps to remove this vulnerability.

"The vulnerable package is System.Text.Encodings.Web. Upgrading your package and redeploying your app should be sufficient to address this vulnerability," Microsoft explained.

Any .NET 5, .NET Core, or .NET Framework-based app using a System.Text.Encodings.Web package version listed below is exposed to attacks.

Package Name	Vulnerable Versions	Secure Versions
System.Text.Encodings.Web	4.0.0 - 4.5.0	4.5.1
System.Text.Encodings.Web	4.6.0-4.7.1	4.7.2
System.Text.Encodings.Web	5.0.0	5.0.1

While Visual Studio also contains the binaries for .NET, it is not vulnerable to this issue, according to Microsoft's security advisory.

The update is offered to include the .NET files so that apps built using Visual Studio including .NET functionality will be protected from this security issue.

"If you have questions, ask them in GitHub, where the Microsoft development team and the community of experts are closely monitoring for new issues and will provide answers as soon as possible," Microsoft added.

Microsoft has also recently announced that it would be making it easier to update PowerShell on Windows 10 and Windows Server by releasing future updates through the Microsoft Update service.

 

[ForgottenSeer 85179]

So, is Windows internal Powershell (5.1.19041.1023) affected? No info on that.

Related to Microsoft Security Advisory CVE-2021-26701 | .NET Core Remote Code Execution Vulnerability · Issue #49377 · dotnet/runtime
i don't even have that folder and the dotnet command doesn't work.

 

[ForgottenSeer 85179]

So, is Windows internal Powershell (5.1.19041.1023) affected? No info on that.

Related to Microsoft Security Advisory CVE-2021-26701 | .NET Core Remote Code Execution Vulnerability · Issue #49377 · dotnet/runtime
i don't even have that folder and the dotnet command doesn't work.

Got my answer:
The affected version of PowerShell isn't bundled with the OS

 

[upnorth]

Windows PowerShell 5.1 isn’t affected by this issue.

Update PowerShell versions 7.0 and 7.1 to protect against a remote ...

If you manage your Azure resources from PowerShell, update versions 7.0 and 7.1 of PowerShell as soon as possible.

azure.microsoft.com

Check your version either with PowerShell or CMD:

powershell -command "(Get-Variable PSVersionTable -ValueOnly).PSVersion"

 

[ForgottenSeer 69673]

blocking powershell should block this, right?

 

[ForgottenSeer 85179]

blocking powershell should block this, right?

No but it's always recommended.
Anyway, see my above post. I'm sure you're not affected.

 

[ForgottenSeer 69673]

blocking powershell should block this, right?

if the effected version is not bundled with the os, where is it coming from?