CVE-2020-0951 Explained : Impact and Mitigation

Windows Defender Application Control Security Feature Bypass Vulnerability was published on 2020-09-08 by Microsoft. The vulnerability affects various versions of Windows 10, Windows Server, and PowerShell.

Understanding CVE-2020-0951

A security feature bypass vulnerability in Windows Defender Application Control could allow an attacker to execute PowerShell commands bypassing WDAC enforcement.

What is CVE-2020-0951?

A security feature bypass vulnerability in Windows Defender Application Control (WDAC)
Enables an attacker to bypass WDAC enforcement and execute PowerShell commands blocked by WDAC

The Impact of CVE-2020-0951

An attacker with local admin access on a machine running PowerShell could exploit the vulnerability
Allows the execution of arbitrary code through PowerShell commands

Technical Details of CVE-2020-0951

Windows Defender Application Control Security Feature Bypass Vulnerability details.

Vulnerability Description

Exploitable security feature bypass vulnerability in WDAC
Potential execution of unauthorized PowerShell commands

Affected Systems and Versions

Windows 10 versions 1803, 1809, 1909, 1709, 1903, 2004, 1607
Windows Server 2019, 2016
PowerShell 7.0, 7.1

Exploitation Mechanism

Attacker requires local admin access on a system with PowerShell running
Attacker connects to a PowerShell session to send commands to execute code

Mitigation and Prevention

Ways to mitigate and prevent the CVE-2020-0951 vulnerability.

Immediate Steps to Take

Apply the security update provided by Microsoft
Ensure WDAC protection is enabled on affected systems
Monitor for any suspicious PowerShell activity

Long-Term Security Practices

Regularly update Windows and PowerShell to patch vulnerabilities
Implement least privilege access to limit potential attack surfaces

Patching and Updates

Microsoft released an update to address the vulnerability by validating PowerShell commands under WDAC protection
Regularly check for updates and apply security patches as soon as they are available