SCCM Vulnerability Chain Exposes Enterprises to Remote Code Execution

Researchers at XM Cyber discovered a vulnerable chain of four weaknesses in Microsoft's System Center Configuration Manager (SCCM) that can lead to remote code execution as 'NT AUTHORITY/system' on the primary site server.

The attack requires network access to the SCCM environment and combines broken authorization, path-traversal flaws, weak code-signing validation, and unsigned DLL-loading paths. While Microsoft fixed one of the flaws in July, the remaining links in the chain are not expected to be fully addressed until ConfigMgr 2609, scheduled for October.

The attack begins with SCCM's AdminService API, which allows an authenticated Active Directory user to submit a malicious CAB archive without administrative privileges. The 'CabSlip' flaw then enables files to escape their intended temporary extraction directory and be written elsewhere on the filesystem.

XM Cyber used a $58 commercial certificate to demonstrate the attack, highlighting that a code-signing certificate is required but not necessarily an enterprise one. Organizations are advised to restrict network access to the AdminService API and monitor SCCM RBAC assignments for potential vulnerabilities.