Vulnerability in Windows Node Exec-Approval Policy Exposes Systems to EoP

• •A critical vulnerability allows arbitrary code execution via exec-approval policy misconfiguration.
• •Exploitation can occur through whitelisting of LOLBins like mshta and regsvr32.
• •No patches are available, and the vulnerability is actively exploited.

A vulnerability in the Windows node's exec-approval policy allows remote callers to weaken execution restrictions, leading to potential arbitrary code execution. The flaw arises from the improper validation of Allow rules, which can be exploited to whitelist dangerous commands, including living-off-the-land binaries (LOLBins) like mshta and regsvr32. This vulnerability affects systems using the exec-approval policy and can be exploited without proper authorization checks. The issue has been classified under CWE-863 (Incorrect Authorization) and CWE-184 (Incomplete List of Disallowed Inputs). Currently, there are no known patches or fixes released, and the vulnerability is actively being. Security professionals are urged to review their exec-approval policies and limit access to the system.execApprovals.set function. The threat model indicates that a compromised token can lead to a two-step escalation of privileges. The situation remains as the vulnerability is and poses a significant risk to affected systems.