mirror of
https://github.com/NexusOne23/noid-privacy.git
synced 2026-02-07 12:11:53 +01:00
85 lines
3.6 KiB
JSON
85 lines
3.6 KiB
JSON
{
|
|
"Description": "Software Restriction Policies (SRP) for CVE-2025-9491 Mitigation",
|
|
"Documentation": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-9491",
|
|
"CVE": "CVE-2025-9491",
|
|
"Threat": "Windows LNK Remote Code Execution",
|
|
"Status": "Zero-Day, Actively Exploited since 2017",
|
|
"Severity": "High (CVSS 7.0)",
|
|
|
|
"SRPConfiguration": {
|
|
"DefaultLevel": 262144,
|
|
"Description": "Unrestricted - Allow all programs except explicitly blocked",
|
|
"TransparentEnabled": 1,
|
|
"ExecutableTypes": [
|
|
".ADE", ".ADP", ".BAS", ".BAT", ".CHM", ".CMD", ".COM", ".CPL", ".CRT",
|
|
".EXE", ".HLP", ".HTA", ".INF", ".INS", ".ISP", ".LNK", ".MDB", ".MDE",
|
|
".MSC", ".MSI", ".MSP", ".MST", ".OCX", ".PCD", ".PIF", ".REG", ".SCR",
|
|
".SHS", ".URL", ".VB", ".WSC", ".WSF", ".WSH"
|
|
]
|
|
},
|
|
|
|
"PathRules": [
|
|
{
|
|
"Name": "Block LNK from Outlook Temp",
|
|
"Path": "%LOCALAPPDATA%\\Temp\\*.lnk",
|
|
"SecurityLevel": 0,
|
|
"Description": "Blocks .lnk files from Outlook email attachments to prevent CVE-2025-9491 exploitation. Outlook saves attachments to %LOCALAPPDATA%\\Temp\\Content.Outlook\\ before execution.",
|
|
"SaferFlags": 0,
|
|
"Enabled": true,
|
|
"AttackVector": "Email attachments (malicious.lnk via Outlook)",
|
|
"Impact": "Prevents execution of .lnk files from email attachments. Legitimate shortcuts from Start Menu/Desktop/Taskbar still work (different paths)."
|
|
},
|
|
{
|
|
"Name": "Block LNK from Downloads",
|
|
"Path": "%USERPROFILE%\\Downloads\\*.lnk",
|
|
"SecurityLevel": 0,
|
|
"Description": "Blocks .lnk files from browser Downloads folder to prevent CVE-2025-9491 exploitation from web downloads.",
|
|
"SaferFlags": 0,
|
|
"Enabled": true,
|
|
"AttackVector": "Browser downloads (malicious.lnk from web)",
|
|
"Impact": "Prevents execution of .lnk files downloaded from internet. Move .lnk to another location to execute if needed."
|
|
}
|
|
],
|
|
|
|
"Windows11BugFix": {
|
|
"Description": "Windows 11 has a bug where SRP is disabled by presence of certain keys in HKLM\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp",
|
|
"Action": "Remove RuleCount and LastWriteTime keys",
|
|
"RegistryPath": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp",
|
|
"KeysToRemove": ["RuleCount", "LastWriteTime"],
|
|
"Reason": "These keys cause SRP to be ignored on Windows 11. Removing them re-enables SRP functionality."
|
|
},
|
|
|
|
"RegistryPaths": {
|
|
"PolicyRoot": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers",
|
|
"PathRules": "HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\\0\\Paths",
|
|
"Win11BugFix": "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Srp\\Gp"
|
|
},
|
|
|
|
"SecurityLevels": {
|
|
"Disallowed": 0,
|
|
"Unrestricted": 262144,
|
|
"Description": "0 = Block execution, 262144 = Allow execution"
|
|
},
|
|
|
|
"SafeScenarios": [
|
|
"Start Menu shortcuts (C:\\ProgramData\\Microsoft\\Windows\\Start Menu)",
|
|
"Desktop shortcuts (C:\\Users\\<user>\\Desktop)",
|
|
"Taskbar shortcuts (pinned applications)",
|
|
"Program Files shortcuts (C:\\Program Files)",
|
|
"System shortcuts (C:\\Windows)"
|
|
],
|
|
|
|
"BlockedScenarios": [
|
|
"Outlook email attachments (%LOCALAPPDATA%\\Temp\\Content.Outlook)",
|
|
"Browser downloads (%USERPROFILE%\\Downloads)",
|
|
"Temporary Internet Files",
|
|
"Other Temp locations matching patterns"
|
|
],
|
|
|
|
"Testing": {
|
|
"VerifyBlockedPath": "%USERPROFILE%\\Downloads\\test.lnk",
|
|
"ExpectedResult": "Execution blocked with 'This program is blocked by group policy' message",
|
|
"VerifySafePath": "%USERPROFILE%\\Desktop\\test.lnk",
|
|
"ExpectedResult2": "Execution allowed (Desktop not in blocked path list)"
|
|
}
|
|
}
|