Full Report
An anonymous security researcher who uses the "Nightmare Eclipse" handle released a CrowdStrike Falcon zero-day exploit named "FalconFlank" that lets attackers escalate privileges on up-to-date Windows systems. [...]
Analysis Summary
# Vulnerability: FalconFlank Privilege Escalation in CrowdStrike Falcon
## CVE Details
- **CVE ID:** N/A (Currently unassigned zero-day)
- **CVSS Score:** Not yet rated (Estimated High/Critical based on local privilege escalation to SYSTEM)
- **CWE:** Abuse of Functionality / DLL Hijacking (implied by remediation bypass details)
## Affected Systems
- **Products:** CrowdStrike Falcon Sensor, Windows 11, Windows Server 2025
- **Versions:**
- Windows 11 version 25H2 (fully updated)
- Windows Server 2025
- Current versions of CrowdStrike Falcon Sensor
- **Configurations:** Systems with the "Office Malicious Macros Remediation" (File Suspicious Macro Removal) feature enabled.
## Vulnerability Description
FalconFlank is a local privilege escalation (LPE) vulnerability that abuses the "Office Malicious Macros Remediation" feature within the CrowdStrike Falcon Sensor. The flaw allows a low-privileged user to trigger a logic error or a specialized DLL loading sequence during the automated remediation process of a suspicious Office macro. By manipulating how Falcon interacts with the operating system during macro removal, an attacker can cause the sensor to spawn a command prompt or execute arbitrary code with **SYSTEM** privileges.
## Exploitation
- **Status:** PoC available; confirmed "real and working" by external security researchers (e.g., Kevin Beaumont).
- **Complexity:** Medium (Requires specific triggers; EDR may already have signatures for the public PoC code).
- **Attack Vector:** Local (Attacker must already have a presence on the machine to execute the PoC).
## Impact
- **Confidentiality:** Total (Full access to all files and data on the system).
- **Integrity:** Total (Ability to modify system files and security configurations).
- **Availability:** Total (Ability to shut down services or delete system data).
## Remediation
### Patches
- **No official patch currently available.** CrowdStrike is investigating the claims.
### Workarounds
- **Disable Macro Removal Policy:** CrowdStrike advises customers to disable the Windows policy setting: **"Microsoft Office File Suspicious Macro Removal."**
- **Maintain Layered Defense:** Ensure **"Cloud Anti-malware for Microsoft Office Files"** remains enabled, as this provides protection without utilizing the vulnerable remediation component.
- **Support Portal:** Customers should check the CrowdStrike support portal for the internal "FalconFlank Tech Alert."
## Detection
- **Indicators of Compromise:**
- Unexpected spawning of `cmd.exe` or `powershell.exe` with `SYSTEM` privileges, particularly as a child process of security-related services.
- Presence of `FalconFlank` PoC strings in memory or on disk (though these may be obfuscated).
- **Detection Methods:** Monitor for unusual DLL loads in directories associated with Microsoft Office or CrowdStrike remediation temp folders.
## References
- **Researcher PoC:** hxxps[://]github[.]com/MSNightmare/FalconFlank
- **CrowdStrike Support (Login Required):** hxxps[://]supportportal[.]crowdstrike[.]com
- **BleepingComputer Article:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/