Attacker Value
Very High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2020-0683

Disclosure Date: February 11, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka ‘Windows Installer Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0686.

Add Assessment

2
Ratings
Technical Analysis

This privilege escalation through how MSI packages handle symlinks is easily exploitable. Due to the POC being public: https://github.com/padovah4ck/CVE-2020-0683 it is easy to craft your own exploits for this.

Any org without a good patching cadence.would be vulnerable to this as a valid privilege escalation vector.

1
Ratings
Technical Analysis

This is a privilege escalation vulnerability in Windows Installer and, since the proof of concept is public, this is considered as important.

The issue is due to an incorrect impersonation when setting the DACLs and writing to a file. Windows Installer performs these operations with SYSTEM privileges, even if started by an unprivileged user. By creating the proper symbolic links and winning a race condition, it is possible to take full control of any restricted file and escalate privileges.

Note that the current PoC is not weaponized, but it won’t take too long to add the proper payload.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • windows 10 -,
  • windows 10 1607,
  • windows 10 1709,
  • windows 10 1803,
  • windows 10 1809,
  • windows 10 1903,
  • windows 10 1909,
  • windows 7 -,
  • windows 8.1 -,
  • windows rt 8.1 -,
  • windows server 2008 -,
  • windows server 2008 r2,
  • windows server 2012 -,
  • windows server 2012 r2,
  • windows server 2016 -,
  • windows server 2016 1803,
  • windows server 2016 1903,
  • windows server 2016 1909,
  • windows server 2019

Additional Info

Technical Analysis