TabShell
- Product
- Microsoft PowerShell Remoting (Windows PowerShell, PowerShell 7; Exchange remote PowerShell)
- CVE
- CVE-2022-41076
- Disclosed
- 2022-12-13
- CVSS
- 8.5
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Windows PowerShell on supported Windows versions and PowerShell 7.2 before 7.2.8 / 7.3 before 7.3.1; Exchange 2013/2016/2019 remote PowerShell before the Nov 2022 SU
- Fixed
- December 2022 Windows updates; PowerShell 7.2.8 / 7.3.1; Exchange November 2022 SU
Summary
A sandbox escape in restricted PowerShell remoting sessions that was used with OWASSRF/ProxyNotShell against Exchange. An authenticated user in a locked-down remoting endpoint could break out of the NoLanguage restrictions and run arbitrary code, as SYSTEM on Exchange.
Root cause
When a client negotiates an older remoting protocol version, the server registers a TabExpansion helper function in the restricted runspace. Its input reaches command-lookup code (Get-Command), and path traversal in the lookup can load an attacker-chosen module or DLL, escaping the session configuration's language restrictions.
Impact
Authenticated users of a constrained PowerShell endpoint get arbitrary code execution as the endpoint's identity (SYSTEM on Exchange).
Detection
Remoting sessions invoking TabExpansion with path-like arguments; Exchange PowerShell application pool loading DLLs from unusual paths.
Mitigation
Apply December 2022 Windows/PowerShell updates and Exchange security updates; restrict remote PowerShell access.