Arbitrary File Write in CrowdStrike Falcon Sensor for Windows

Executive Summary

This is a vulnerability in CrowdStrike's Falcon sensor for Windows where an arbitrary file write to protected locations can occur from an unprivileged context. It only exists when the Microsoft Office File Malicious Macro Removal policy setting is enabled. The issue is a Time-of-check Time-of-use (TOCTOU) race condition and could lead to local privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking the Falcon sensor version and policy settings. Use CrowdStrike's console to verify if the 'Microsoft Office File Malicious Macro Removal' policy is enabled and if the Cloud Anti-malware for Microsoft Office Files setting is active.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write files to protected locations on your system, potentially gaining elevated privileges. This could allow them to take control of your device or install malicious software.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Falcon sensor to the latest fixed versions (7.34+, 7.32 LTS, or 7.16 for Windows 7/2008 R2). If using the Laroux Malware Cleanup Tool, update it as well. Ensure Cloud Anti-malware for Microsoft Office Files is enabled.

Useful 0 Not Useful 0