CVE-2019-0841 : An elevation of privilege vulnerability exists when Windows AppX Deployment Serv

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

Published 2019-04-09 21:29:02

Updated 2023-03-20 18:09:10

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2019-0841

Microsoft » Windows Server 2016 » Version: 1803
cpe:2.3:o:microsoft:windows_server_2016:1803:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1809
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1703
cpe:2.3:o:microsoft:windows_10_1703:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1709
cpe:2.3:o:microsoft:windows_10_1709:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1803
cpe:2.3:o:microsoft:windows_10_1803:*:*:*:*:*:*:*:*
Matching versions

CVE-2019-0841 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2019-0841

Added on 2022-03-15 Action due date 2022-04-05

Exploit prediction scoring system (EPSS) score for CVE-2019-0841

EPSS FAQ

86.55%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-0841

AppXSvc Hard Link Privilege Escalation

Disclosure Date: 2019-04-09

First seen: 2020-04-26

exploit/windows/local/appxsvc_hard_link_privesc

There exists a privilege escalation vulnerability for Windows 10 builds prior to build 17763. Due to the AppXSvc's improper handling of hard links, a user can gain full privileges over a SYSTEM-owned file. The user can then utilize the new file to e

More information

CVSS scores for CVE-2019-0841

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-0841

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-0841

http://packetstormsecurity.com/files/153215/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html

Microsoft Windows AppX Deployment Service Local Privilege Escalation ≈ Packet Storm
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/46683/

Microsoft Windows - AppX Deployment Service Privilege Escalation
Exploit;Third Party Advisory;VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-360/

ZDI-19-360 | Zero Day Initiative
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/153642/AppXSvc-Hard-Link-Privilege-Escalation.html

AppXSvc Hard Link Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html

Microsoft Windows AppX Deployment Service Local Privilege Escalation ≈ Packet Storm
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html

Microsoft Windows AppX Deployment Service Privilege Escalation ≈ Packet Storm
Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0841

CVE-2019-0841 | Windows Elevation of Privilege Vulnerability
Patch;Vendor Advisory
http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html

Internet Explorer JavaScript Privilege Escalation ≈ Packet Storm
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2019-0841