CVE-2019-1253
HIGH KEV RANSOMWAREWindows 10 1703-1903 and Windows Server 1803-2019 - Privilege Escalation via AppX Deployment Server Junction Handling
Title source: llmExploitation Summary
CVE-2019-1253 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 15, 2022, with confirmed use in ransomware campaigns. EIP tracks 5 public exploits from researchers including Gabor Seljan, padovah4ck, rogue-kdc.
AI-analyzed exploit summary This exploit leverages a vulnerability in AppXSvc where improper handling of file hard links allows a low-privileged user to overwrite the security descriptor of an arbitrary file, leading to elevation of privilege. The PoC involves creating a hard link to a target file and triggering a restore operation to modify its permissions.
Description
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
Exploits (5)
This exploit leverages a vulnerability in AppXSvc where improper handling of file hard links allows a low-privileged user to overwrite the security descriptor of an arbitrary file, leading to elevation of privilege. The PoC involves creating a hard link to a target file and triggering a restore operation to modify its permissions.
This repository contains a functional exploit for CVE-2019-1253, which leverages a hard link vulnerability in Cortana to escalate privileges. The exploit creates a hard link to a target file and manipulates file permissions to gain unauthorized access.
This repository contains a functional exploit for CVE-2019-1253, a privilege escalation vulnerability in Microsoft Windows. The exploit leverages a directory junction attack to delete privileged files by manipulating the Microsoft Edge settings directory.
This repository contains a functional exploit for CVE-2019-1253, a local privilege escalation vulnerability in Microsoft Edge. The exploit leverages hard link creation to manipulate file permissions and escalate privileges.
This repository contains a functional exploit for CVE-2019-1253, a privilege escalation vulnerability in Microsoft Edge. The exploit leverages a directory junction attack to delete privileged files by manipulating the Edge browser's settings directory.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H