CVE-2015-0016
Microsoft Windows TS WebProxy Directory Traversal Vulnerability
Description
CVE-2015-0016 is a directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component of Microsoft Windows that allows remote attackers to escalate privileges. The flaw exists in the Terminal Services WebProxy component, which fails to properly sanitize file path inputs, enabling an attacker to traverse directory boundaries and access or execute files outside the intended directory. This Windows privilege escalation vulnerability can be exploited remotely and represents a significant security risk for systems running affected Windows versions. CISA has listed CVE-2015-0016 in the Known Exploited Vulnerabilities catalog, confirming active exploitation, and its EPSS percentile of 99.7% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/(Exploit)
- http://packetstormsecurity.com/files/130201/MS15-004-Microsoft-Remote-Desktop-Services-Web-Proxy-IE-Sandbox-Escape.html(Exploit, Third Party Advisory, VDB Entry)
- http://secunia.com/advisories/62076(Broken Link)
- http://www.exploit-db.com/exploits/35983(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/71965(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1031524(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-004(Patch, Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99515(Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99516(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0016(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2015-0016 in the NVD database. The vulnerability is a directory traversal (path traversal) flaw in the TS WebProxy component. Directory traversal vulnerabilities occur when an application fails to properly sanitize user-supplied file path input, allowing sequences like "../" to navigate outside the intended directory structure. In the TSWbPrxy component, this enables an attacker to access or execute files in locations that should be restricted, leading to privilege escalation.
Learn more: CWE Overview
Impact Analysis
CVE-2015-0016 enables privilege escalation through a directory traversal vulnerability in the Windows TS WebProxy component. The vulnerability is remotely exploitable over the network, which significantly amplifies its severity compared to local-only privilege escalation flaws. Confidentiality (High): Through directory traversal, an attacker can access sensitive system files, configuration data, and credentials that are normally restricted to privileged users. Integrity (High): Privilege escalation allows the attacker to modify system files, install persistent backdoors, and alter security configurations. Availability (High): An attacker with escalated privileges can disrupt system services, disable security controls, or render the system inoperable. With an EPSS percentile of 99.7%, this vulnerability has a near-certain probability of active exploitation, placing it among the most exploited Windows vulnerabilities.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2015-0016 by listing it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 15, 2022. The EPSS percentile of 99.7% places this vulnerability among the most actively exploited, indicating near-certain exploitation activity. The remote attack vector combined with the privilege escalation capability makes CVE-2015-0016 particularly valuable to attackers, as it can serve as both an initial access vector and a privilege escalation step in multi-stage attacks against Windows systems running Terminal Services.
Remediation
- Apply Microsoft security updates per vendor instructions as required by the CISA KEV catalog. Install all relevant patches that address CVE-2015-0016 in the TS WebProxy component.
- Disable the TS WebProxy component if it is not actively required in your environment. Reducing the attack surface by removing unnecessary Terminal Services components prevents exploitation of this and similar vulnerabilities.
- Restrict network access to Terminal Services using firewall rules and network segmentation. Ensure that Remote Desktop and related services are only accessible from trusted networks and require VPN access for remote connections.
- Implement application whitelisting and path restrictions to prevent execution of files accessed through directory traversal. Use Windows Defender Application Control or similar tools to restrict which executables can run on the system.
- Monitor for directory traversal attack patterns in web server and application logs. Look for path traversal sequences (../, ....) in HTTP requests to the TS WebProxy component, and configure intrusion detection systems to alert on these patterns.
Technical Details
CVE-2015-0016 is a directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component of Microsoft Windows. The TSWbPrxy component is part of Windows Terminal Services (Remote Desktop Services) and handles web proxy functionality for remote sessions. The vulnerability exists because the component fails to properly validate and sanitize file path inputs, allowing an attacker to include directory traversal sequences in requests to navigate outside the intended directory. By crafting a request with path traversal characters, an attacker can access files in arbitrary locations on the file system, including system directories containing executables and configuration files. The remote attack vector means this can be exploited over the network through specially crafted requests to the Terminal Services web proxy, and the resulting file access outside intended boundaries leads to privilege escalation when combined with execution of privileged files.
Frequently Asked Questions
Is CVE-2015-0016 being actively exploited?
Yes, CVE-2015-0016 is actively exploited. CISA confirmed its inclusion in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. The EPSS percentile of 99.7% indicates near-certain exploitation activity, placing it among the most exploited vulnerabilities.
What products are affected by CVE-2015-0016?
CVE-2015-0016 affects Microsoft Windows through the TS WebProxy (TSWbPrxy) component, which is part of Terminal Services (Remote Desktop Services). Organizations running Windows systems with Terminal Services enabled should consult Microsoft security bulletins for specific affected versions.
How do I fix CVE-2015-0016?
Apply Microsoft security updates that address this vulnerability. If the TS WebProxy component is not needed, disable it to eliminate the attack surface. Restrict network access to Terminal Services using firewalls and VPN requirements.
How severe is CVE-2015-0016?
CVE-2015-0016 is a remotely exploitable privilege escalation vulnerability with an EPSS percentile of 99.7%, indicating near-certain exploitation. The combination of remote exploitability and privilege escalation makes this a critical priority for patching on all affected Windows systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.