Microsoft Windows Task Scheduler SetJobFileSecurityByName privilege escalation vulnerability

Overview

Microsoft Windows contains a privilege escalation vulnerability in the way that theTask Scheduler SetJobFileSecurityByName() function is used, which can allow an authenticated attacker to gain SYSTEM privileges on an affected system.

Description

Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The front-end components of Task Scheduler, such as schtasks.exe, are interfaces that allow for users to view, create, and modify scheduled tasks. The back-end part of Task Scheduler is a Windows service that runs with SYSTEM privileges. One of the libraries used by the Task Scheduler service, schedsvc.dll, has a function called tsched::SetJobFileSecurityByName(), which sets permissions of job files. The permissions of the job file in the %Windir%\system32\tasks directory are modified to give the calling user full permissions to the job file that they have created.

At the point where the SetSecurityInfo() function is called, the Task Scheduler service has the NT Authority\SYSTEM security token. This means that the Task Scheduler service can give full user access permissions to files that may only be controlled by the SYSTEM or other privileged accounts.

Public proof-of-concept exploit code leverages the legacy schtasks.exe and schedsvc.dll code from Windows XP to take advantage of these high privilege levels when setting file permissions. Versions of Windows prior to Vista used job files in the %Windir%\tasks directory. Legacy versions of schtasks.exe will cause these jobs to be migrated to the %Windir%\system32\tasks directory when those program versions are executed on modern Windows platforms. In conjunction with the SYSTEM security token used by the Task Scheduler service, this migration behavior can be used along with hard links to grant full permissions of protected files to any user on a Windows system.

We have confirmed that the public exploit code functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019. While Windows 8 still contains this vulnerability, exploitation using the publicly-described technique is limited to files where the current user has write access, in our testing. As such, the impact on Windows 8 systems using the technique used by the public exploit appears to be negligible. We have not been able to demonstrate the vulnerability on Windows 7 systems.

---

Impact

By leveraging the Windows Task Scheduler service, an authenticated attacker can gain full access to protected files. This can allow complete system compromise from a limited Windows user account.

---

Solution

Apply an update

This issue is addressed in the updates for CVE-2019-1069 from Microsoft.

---

Vendor Information

119704

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft __ Affected

Notified: May 21, 2019 Updated: May 22, 2019

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

We have confirmed that fully-patched Windows 10, Server 2016, and Server 2019 are affected by the public exploit code for this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23119704 Feedback>).

CVSS Metrics

Group	Score	Vector
Base	6.8	AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal	6.5	E:F/RL:U/RC:C
Environmental	6.4	CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

• <https://github.com/SandboxEscaper/polarbearrepo&gt;
• <https://docs.microsoft.com/en-us/windows/desktop/api/aclapi/nf-aclapi-setsecurityinfo&gt;
• <https://docs.microsoft.com/en-us/windows/desktop/fileio/hard-links-and-junctions&gt;
• <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069&gt;
• <https://www.thezdi.com/blog/2019/6/11/exploiting-the-windows-task-scheduler-through-cve-2019-1069&gt;

Acknowledgements

This vulnerability was publicly disclosed by SandboxEscaper.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2019-1069
Date Public:	2019-05-21 Date First Published: