What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

Privilege Escalation Flaw in Windows Task Scheduler

February 27, 2019 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

On August 27th, an independent security researcher released a vulnerability in Windows Task Scheduler [1]. If exploited the vulnerability would allow a threat actor, with pre-established access to the system, to raise their privilege from user-mode privileges to full system privileges. At the time of writing this attack has not been seen in the wild, but Proof of Concept (PoC) code has been publicly released, increasing the likelihood that threat actors will quickly adapt and employ this attack. Windows 10 and Windows Server 2016 systems are vulnerable to this privilege escalation method. The vulnerability and PoC were publicly released without giving the vendor notice; as such security patches are not yet available.

What we’re doing about it

What you should do about it

Additional information

The major concern relating to this vulnerability is that threat actors may incorporate it into their malware. This would greatly increase the potential damage attacks by giving threat actors a higher privilege level than otherwise possible.

The flaw stems from the Task Scheduler API function, SchRpcSetSecurity, which fails to check permissions. Any account can call it and set file permissions on anything on the system [3].


References:

[1] Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interface Vulnerability Note VU#906424
https://www.kb.cert.org/vuls/id/906424

[2] CVE-2018-8440 | Windows ALPC Elevation of Privilege Vulnerability Security Vulnerability
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8440

[3] Double Pulsar: Task Scheduler ALPC exploit high-level analysis – CVE-2018–8440
https://doublepulsar.com/task-scheduler-alpc-exploit-high-level-analysis-ff08cda6ad4f

View Most Recent Advisories