CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
75.0%
Microsoft Windows contains a privilege escalation vulnerability in the way that theTask Scheduler SetJobFileSecurityByName()
function is used, which can allow an authenticated attacker to gain SYSTEM privileges on an affected system.
Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The front-end components of Task Scheduler, such as schtasks.exe
, are interfaces that allow for users to view, create, and modify scheduled tasks. The back-end part of Task Scheduler is a Windows service that runs with SYSTEM privileges. One of the libraries used by the Task Scheduler service, schedsvc.dll
, has a function called tsched::SetJobFileSecurityByName()
, which sets permissions of job files. The permissions of the job file in the %Windir%\system32\tasks
directory are modified to give the calling user full permissions to the job file that they have created.
At the point where the SetSecurityInfo() function is called, the Task Scheduler service has the NT Authority\SYSTEM
security token. This means that the Task Scheduler service can give full user access permissions to files that may only be controlled by the SYSTEM or other privileged accounts.
Public proof-of-concept exploit code leverages the legacy schtasks.exe
and schedsvc.dll
code from Windows XP to take advantage of these high privilege levels when setting file permissions. Versions of Windows prior to Vista used job files in the %Windir%\tasks
directory. Legacy versions of schtasks.exe
will cause these jobs to be migrated to the %Windir%\system32\tasks
directory when those program versions are executed on modern Windows platforms. In conjunction with the SYSTEM security token used by the Task Scheduler service, this migration behavior can be used along with hard links to grant full permissions of protected files to any user on a Windows system.
We have confirmed that the public exploit code functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019. While Windows 8 still contains this vulnerability, exploitation using the publicly-described technique is limited to files where the current user has write access, in our testing. As such, the impact on Windows 8 systems using the technique used by the public exploit appears to be negligible. We have not been able to demonstrate the vulnerability on Windows 7 systems.
By leveraging the Windows Task Scheduler service, an authenticated attacker can gain full access to protected files. This can allow complete system compromise from a limited Windows user account.
Apply an update
This issue is addressed in the updates for CVE-2019-1069 from Microsoft.
119704
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: May 21, 2019 Updated: May 22, 2019
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
We have confirmed that fully-patched Windows 10, Server 2016, and Server 2019 are affected by the public exploit code for this vulnerability.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23119704 Feedback>).
Group | Score | Vector |
---|---|---|
Base | 6.8 | AV:L/AC:L/Au:S/C:C/I:C/A:C |
Temporal | 6.5 | E:F/RL:U/RC:C |
Environmental | 6.4 | CDP:ND/TD:H/CR:ND/IR:ND/AR:ND |
This vulnerability was publicly disclosed by SandboxEscaper.
This document was written by Will Dormann.
CVE IDs: | CVE-2019-1069 |
---|---|
Date Public: | 2019-05-21 Date First Published: |
docs.microsoft.com/en-us/windows/desktop/api/aclapi/nf-aclapi-setsecurityinfo
docs.microsoft.com/en-us/windows/desktop/fileio/hard-links-and-junctions
github.com/SandboxEscaper/polarbearrepo
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069
www.thezdi.com/blog/2019/6/11/exploiting-the-windows-task-scheduler-through-cve-2019-1069
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
75.0%