It took $58 to break Microsoft’s SCCM, but a patch made it harder

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4209154/it-took-58-to-break-microsofts-sccm-but-a-patch-made-it-harder.html

ONE SENTENCE SUMMARY:

XM Cyber showed low-privilege AD users can chain SCCM flaws to gain SYSTEM RCE, potentially compromising all managed clients.

MAIN POINTS:

1. SCCM manages OS deployment, patching, software distribution, and compliance across enterprise Windows fleets.
2. Attack chain escalates from standard domain user to NT AUTHORITY\SYSTEM on primary site server.
3. Compromising the site server effectively compromises all SCCM-managed client endpoints.
4. Four weaknesses were chained: broken authorization, CabSlip traversal, weak signature validation, unsafe DLL loading.
5. AdminService “chunked-upload” lacked permission checks, enabling CAB upload without SCCM admin rights.
6. Microsoft patched CVE-2026-47301 in July, addressing the original standard-user upload path.
7. Operations Administrator or equivalent Create permission can still reach the downstream exploit chain.
8. CabSlip enables arbitrary file write by escaping the intended CAB extraction directory.
9. SMS Executive loads adsource.dll without validating its signature, enabling SYSTEM execution on load.
10. Signature checks accept cheap commercial certificates; revocation checking is disabled, weakening trust enforcement.

TAKEAWAYS:

1. Segment and restrict network access to SCCM AdminService to reduce reachable attack surface.
2. Audit RBAC roles, especially Operations Administrator and custom roles with SMS_ConsoleExtensionData Create rights.
3. Investigate AdminService.log for DirectoryNotFoundException followed by HTTP 500 as traversal indicator.
4. Watch for unexpected changes to adsource.dll in the ConfigMgr installation directory.
5. Plan for additional remediation beyond July’s patch, with fuller fixes expected in ConfigMgr 2609.