CVE-2023-28252

CVE-2023-28252 is a critical Elevation of Privilege vulnerability, affecting the Windows Common Log File System (CLFS) driver. This flaw was discovered by Kaspersky researchers while investigating zero-day vulnerabilities in Windows aimed at preventing user attacks. The vulnerability presents a significant risk to systems, with a high Qualitative Disaster Severity (QDS) score of 95 and a Common Vulnerability Scoring System (CVSS) score of 7.8, indicating its potential for severe impact on system integrity. The exploitation process of this vulnerability, CVE-2023-28252, bears a striking resemblance to another exploit, CVE-2023-23376. Microsoft assigned the identifier 'CVE-2023-28252' to this zero-day bug upon discovery. The threat actor initially gained access to the organization through a Qakbot infection, subsequently exploiting the Windows CLFS vulnerability to elevate their privileges on affected devices. Following the successful exploitation of CVE-2023-28252, the threat actor used Cobalt Strike and Pypykatz, a Python version of Mimikatz, to steal the credentials of two domain administrators. This action facilitated lateral movement to four domain controllers, further compromising the security of the organization's network. The discovery and subsequent analysis of this vulnerability underline the importance of continuous vigilance and timely patching in maintaining system security.