PT-2022-3135 · Microsoft · File Server Shadow Copy Agent Service+1

Published 2022-05-03 · Updated 2025-01-02 · CVE-2022-30154

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft File Server Shadow Copy Agent Service (RVSS) (affected versions not specified)

Description The issue is related to insufficient access restrictions in the Microsoft File Server Shadow Copy Agent Service (RVSS), which can be exploited by an attacker to bypass security restrictions and elevate their privileges. This vulnerability, also known as ShadowCoerce, allows attackers to target Windows servers in NTLM Relay attacks, forcing vulnerable servers to authenticate and potentially capturing the domain. The vulnerability was first described in detail by researcher Lionel Gilles in 2021, demonstrating an attack known as PetitPotam. It is also vulnerable to NTLM relay attacks, which can force a domain controller to authenticate a malicious NTLM relay under the control of a hacker. This can allow the attacker to impersonate any network device, including the Windows domain controller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-03814

CVE-2022-30154

Affected Products

File Server Shadow Copy Agent Service

Windows

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30154 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30154 · Security Note
• https://bdu.fstec.ru/vul/2022-03814 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-30154 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30154 · Vendor Advisory
• https://twitter.com/fletch_ai/status/1744933847060422714 · Twitter Post
• https://vuldb.com/ru/?id.201841 · Note
• https://t.me/cvenotify/32147 · Telegram Post
• https://t.me/true_secator/3144 · Telegram Post