New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges
-
An anonymous security researcher operating under the alias Nightmare Eclipse has published details and a proof-of-concept for a zero-day privilege escalation exploit targeting the CrowdStrike Falcon endpoint protection platform. Dubbed FalconFlank, the exploit reportedly allows an attacker to achieve SYSTEM-level privileges on fully patched Windows environments, effectively bypassing the kernel-level protections the security software is designed to enforce.
The exploit abuses a flaw in how the Falcon sensor handles specific interprocess communication, enabling a locally authenticated user to escalate their access. Given that CrowdStrike Falcon runs with the highest integrity levels on Windows, this vulnerability is particularly severe, as it can render the host’s primary defense mechanism useless after compromise. Nightmare Eclipse has stated that the issue affects current, up-to-date versions of the Falcon agent and did not provide a patch timeline, leaving enterprise defenders in a precarious position.
Based on the technical write-up accompanying the release, the core issue involves a race condition within the sensor's driver interface. The researcher demonstrated that by manipulating file system redirection, an attacker can force the Falcon service to execute arbitrary code in the context of the kernel. This technique effectively neutralizes the Next-Gen AV and Endpoint Detection and Response (EDR) capabilities before any malicious activity is detected.
Key threat details provided in the report include:
- The exploit requires local access to the machine, not remote execution.
- It successfully bypasses Credential Guard and other virtualization-based security features.
- No user interaction is required once the initial foothold (e.g., via a phishing email or a malicious download) is established.
At the time of writing, CrowdStrike has not issued an official CVE identifier for this issue, nor have they released a committed fix. System administrators running Falcon are advised to monitor the Falcon console for emergency policy updates and consider restricting local admin rights to mitigate the initial attack vector.
Source: Unknown
Given the lack of a public CVE or vendor patch, has your team started investigating whether your existing Falcon deployment is vulnerable to this local exploit vector yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login