Loading vulnerability…
CVE-2023-28252 is a local elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, implemented in CLFS.sys. It affects the CLFS subsystem used for log file handling on Windows and was reported by Microsoft as exploited in the wild as a zero-day. Available reporting consistently characterizes the flaw as a CLFS driver privilege-escalation issue, and some reporting maps it to CWE-122, indicating a heap-based buffer overflow in the CLFS driver. Exploitation occurs after initial compromise and allows an attacker running with limited privileges to abuse the vulnerable CLFS component to transition to higher privileges on the local system. The vulnerability has been associated with real-world intrusion chains in which attackers first obtained access through malware infection or other footholds and then exploited the CLFS flaw before deploying ransomware or conducting broader post-exploitation activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (Ruby file) that exploits CVE-2023-28252, a privilege escalation vulnerability in the Windows Common Log File System (clfs.sys) driver. The exploit targets Windows 10 21H2, Windows 11 21H2, and Windows Server 20348, leveraging specially crafted .blf files and memory manipulation to achieve SYSTEM privileges. The module checks for the presence of the vulnerable driver and appropriate Windows version, then injects a user-supplied Meterpreter payload via a reflective DLL. The attack vector is local, requiring an existing session on the target. The structure is typical for a Metasploit exploit: it includes metadata, a check method for vulnerability assessment, and an exploit method for payload execution. Notable fingerprintable endpoints include the clfs.sys driver path and the use of crafted .blf files. The exploit is weaponized, allowing for customizable payloads and full SYSTEM access upon success.
This repository contains a functional local privilege escalation exploit for CVE-2023-28252, a vulnerability in the Windows Common Log File System (CLFS) driver (CLFS.sys). The exploit is implemented in C++ and is designed to run on Windows 10/11 (21H2/22H2) and Windows Server 2022 with vulnerable versions of CLFS.sys. The exploit works by crafting and manipulating .blf log files and leveraging kernel memory operations to overwrite the process token, thereby granting SYSTEM privileges to the attacker. The main entry point is 'clfs_eop/clfs_eop.cpp', which orchestrates the environment setup, kernel address discovery, file crafting, and the actual privilege escalation. The exploit does not require network access and must be executed locally. The repository includes supporting headers and Visual Studio project files, but the core logic resides in the C++ source files. No external endpoints are targeted; the attack is purely local, focusing on the CLFS.sys driver and associated log files.
This repository contains a working local privilege escalation exploit for CVE-2023-28252, a vulnerability in the Microsoft Windows Common Log File System (CLFS) driver (CLFS.SYS). The main exploit logic is implemented in C++ (lib/clfs_eop.cpp and lib/clfs_eop.h), with supporting project files for Visual Studio. The exploit works by manipulating kernel memory structures via the CLFS driver to obtain a SYSTEM token, thereby elevating the attacker's privileges to SYSTEM. The code includes logic for kernel address discovery, pipe spraying, and direct system calls to achieve the exploit. The repository also includes two simple VBScript files (encrypt.vbs and decrypt.vbs) for text encoding/decoding, which are unrelated to the main exploit. The exploit targets multiple versions of Windows 10, Windows 11, and Windows Server (2016, 2019, 2022) as specified in the header comments. The attack vector is local, requiring the attacker to execute code on the target system. The main fingerprintable endpoint is the CLFS.SYS driver file. The exploit is operational and provides SYSTEM-level access if successful.
This repository contains a C++ implementation of a local privilege escalation exploit for CVE-2023-28252, targeting the Windows Common Log File System (CLFS) driver (clfs.sys). The exploit is based on Fortra's original proof-of-concept and is modified to allow the user to specify an arbitrary binary to execute as SYSTEM after successful exploitation. The main code is in 'clfs_eop/clfs_eop.cpp', with supporting headers and Visual Studio project files. The exploit works by manipulating kernel memory structures via the vulnerable driver, ultimately replacing the current process token with a SYSTEM token and then executing the specified payload. The exploit is operational and can be used to run any command or binary as SYSTEM on affected Windows versions. The only fingerprintable endpoint is the path to the vulnerable driver. The repository is well-structured for building with Visual Studio and includes both source and project files.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior vulnerability in the Windows CLFS.sys subsystem referenced as part of a pattern of recurring CLFS driver flaws.
A vulnerability exploited by BrainCipher ransomware (a LockBit 3.0 variant) to compromise Windows and Linux systems in healthcare organizations.
A local privilege escalation vulnerability in Microsoft Windows, allowing attackers to gain elevated privileges on a compromised system.
A Windows Common Log File System (CLFS) vulnerability used for local privilege escalation during the intrusion chain prior to ESXi targeting.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.