⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-04-05.

CVE-2019-1253 — Link Following in Microsoft Windows

CWE-59 — Link FollowingCWE-269 — Improper Privilege ManagementCWE-79 — Cross-site Scripting17 documents10 sources
Severity
7.8HIGHNVD
EPSS
31.9%
top 3.18%
CISA KEV
KEVRansomware
Added 2022-03-15
Due 2022-04-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
26
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+23 more
Timeline
PublishedSep 11
KEV addedMar 15
KEV dueApr 5
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages24 packages

▶CVEListV5microsoft/windows_server2019, 2019 (Core installation), version 1803 (Core Installation)+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-wp5j-ppw9-22mw: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions↗2022-05-24
▶
GHSA
GHSA-63x7-m3j2-hxwg: An elevation of privilege vulnerability exists in the way that ws2ifsl↗2022-05-24
▶
GHSA
GHSA-mgf9-3fp9-mhfh: An elevation of privilege vulnerability exists in the way that the unistore↗2022-05-24
▶
GHSA
GHSA-2fr6-xf6c-rwpx: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions↗2022-05-24
▶
VulnCheck
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability↗2019
▶

💥Exploits & PoCs

1
Exploit-DB
AppXSvc - Privilege Escalation↗2019-09-16
▶

🔍Detection Rules

1
YARA
HKTL_NET_GUID_CVE_2019_1253↗
▶

📋Vendor Advisories

3
CISA
Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability↗2022-03-15
▶
Microsoft
Windows Elevation of Privilege Vulnerability↗2019-09-10
▶
Red Hat
jenkins-plugin-config-file-provider: Stored XSS vulnerability in Config File Provider Plugin (SECURITY-1253)↗2019-01-28
▶

🕵️Threat Intelligence

2
Tenable
ContiLeaks: Chats Reveal Over 30 Vulnerabilities Used by Conti Ransomware – How Tenable Can Help↗2022-03-24
▶
Tenable
Microsoft's September 2019 Patch Tuesday: Tenable Roundup↗2019-09-10
▶

💬Community

1
Bugzilla
CVE-2019-1003014 jenkins-plugin-config-file-provider: Stored XSS vulnerability in Config File Provider Plugin (SECURITY-1253)↗2019-01-31
▶
CVE-2019-1253 — Link Following in Microsoft Windows | cvebase