Very High
CVE-2020-0683
CVE-2020-0683
Description
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka ‘Windows Installer Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0686.
Add Assessment
Technical Analysis
This privilege escalation through how MSI packages handle symlinks is easily exploitable. Due to the POC being public: https://github.com/padovah4ck/CVE-2020-0683 it is easy to craft your own exploits for this.
Any org without a good patching cadence.would be vulnerable to this as a valid privilege escalation vector.
Technical Analysis
This is a privilege escalation vulnerability in Windows Installer and, since the proof of concept is public, this is considered as important.
The issue is due to an incorrect impersonation when setting the DACLs and writing to a file. Windows Installer performs these operations with SYSTEM privileges, even if started by an unprivileged user. By creating the proper symbolic links and winning a race condition, it is possible to take full control of any restricted file and escalate privileges.
Note that the current PoC is not weaponized, but it won’t take too long to add the proper payload.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 -,
- windows 10 1607,
- windows 10 1709,
- windows 10 1803,
- windows 10 1809,
- windows 10 1903,
- windows 10 1909,
- windows 7 -,
- windows 8.1 -,
- windows rt 8.1 -,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016 -,
- windows server 2016 1803,
- windows server 2016 1903,
- windows server 2016 1909,
- windows server 2019
