CVE-2021-28313: 
vulnerability analysis and mitigation

CVE-2021-28313 is an elevation of privilege vulnerability in the Microsoft Diagnostics Hub Standard Collector Service, a default component of Microsoft Windows operating system. The vulnerability was discovered and disclosed in April 2021, affecting multiple versions of Windows 10, Windows Server 2016, Windows Server 2019, and Visual Studio versions 2015 Update 3 through 2019 (Microsoft Support).

The vulnerability exists when the Diagnostics Hub Standard Collector Service incorrectly handles data operations. The service was vulnerable to directory traversal which could lead to data tampering and dropping files to arbitrary directories. The flaw specifically relates to the DCOM class that is available to all authenticated users of the operating system. The vulnerability exploits a case-sensitivity issue in the NTFS file system, particularly when Windows Subsystem for Linux is installed or when per-directory case-insensitivity features are enabled (Security Lists).

The vulnerability allows an authenticated attacker to execute arbitrary code with SYSTEM privileges, effectively gaining complete control over the affected system. The attacker could take over file permissions of existing files and, when combined with other techniques, could achieve elevation of privileges to NT_AUTHORITY\SYSTEM (Security Lists).

The vulnerability requires local access and can be exploited by an authenticated user. Proof-of-concept code has been publicly released demonstrating the exploitation of this vulnerability through directory traversal techniques (Packet Storm).

Microsoft released security updates in April 2021 to address this vulnerability. Users are advised to install the appropriate updates for their affected systems, including Visual Studio 2015 Update 3 and the subsequent Cumulative Servicing Release KB 3165756 (Microsoft Support).