CVE-2019-1385: Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

Vulnerability summary

CVE-2019-1385 is a high (CVSS 7.8) Link Following vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 23-05-2022. It has been used in ransomware campaigns. EPSS estimates a 3.60% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities.

Timeline

1. 12-11-2019
   PublishedVulnerability first disclosed.
2. 23-05-2022
   Added to CISA KEVMicrosoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
3. 13-06-2022
   CISA remediation dueApply updates per vendor instructions.
4. 12-08-2026
   Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.