CVE-2020-0787

CVE-2020-0787: Windows BITS Symbolic Link Privilege Escalation

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2020-0787 is a local elevation of privilege vulnerability in the Windows Background Intelligent Transfer Service (BITS). The service fails to properly handle symbolic links, allowing an attacker to manipulate file system operations to gain elevated privileges. First disclosed in March 2020, this vulnerability has been actively exploited since January 2022 and carries a HIGH CVSS v3 score of 7.8.

Background

Windows Background Intelligent Transfer Service (BITS) is a built-in component that manages background file transfers using idle network bandwidth. It is commonly used by Windows Update, Microsoft Defender, and other system components to download files without impacting foreground network performance. Because BITS operates with elevated privileges and interacts with the file system on behalf of user processes, it represents a high-value target for privilege escalation attempts.

Root Cause

The vulnerability is classified under CWE-59: Improper Link Resolution Before File Access ('Link Following'). BITS does not adequately validate or resolve symbolic links before performing privileged file operations. When BITS processes a file path that contains a symbolic link, it may follow the link to an attacker-controlled destination, allowing the attacker to redirect privileged operations—such as file creation or modification—to arbitrary locations. This effectively breaks the intended boundary between low-privileged user space and the privileged BITS service.

Impact

With a CVSS v3 score of 7.8 (HIGH) and a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the impact is severe:

• Confidentiality: HIGH — an attacker can read sensitive files by redirecting BITS to access protected data.
• Integrity: HIGH — arbitrary file modifications are possible, including the replacement of system binaries.
• Availability: HIGH — critical system files can be corrupted or overwritten, potentially causing system instability.

The local attack vector means an attacker must already have access to the system (e.g., via a compromised standard user account), but the attack complexity is low and no privileges are required to trigger the vulnerable code path.

Exploitation Walkthrough

The exploitation strategy leverages the fact that BITS runs with elevated privileges and follows symbolic links without proper validation. A low-privileged attacker can:

1. Create a job that instructs BITS to write a file to a location they control.
2. Replace the target directory or file with a symbolic link pointing to a protected system directory.
3. Allow BITS to follow the link and write privileged data to the attacker-specified destination.

Ethics and Legal Notice: The following description is defensive in nature and does not provide weaponized exploit code. Attempting to exploit this vulnerability on systems without explicit authorization is illegal and unethical. The description is intended to help defenders understand the attack surface and build effective detection rules.

Affected and Patched Versions

Microsoft patched this vulnerability in the March 2020 security updates. The following versions were confirmed vulnerable:

• Windows 10 (1507, 1607, 1709, 1803, 1809, 1903, 1909)
• Windows 7 SP1
• Windows 8.1
• Windows RT 8.1
• Windows Server 1803, 1903, 1909
• Windows Server 2008 (SP2, R2 SP1)
• Windows Server 2012 and 2012 R2
• Windows Server 2016
• Windows Server 2019

Organizations should verify that March 2020 (or later) cumulative updates are installed on all affected systems.

Remediation

1. Patch: Apply the Microsoft security update released in March 2020. Ensure all Windows endpoints and servers receive the relevant cumulative update via Windows Update, WSUS, or your patch management platform.
2. Compensating Controls:
   • Enforce principle of least privilege to limit the number of standard user accounts that can interact with BITS.
   • Use AppLocker or Windows Defender Application Control (WDAC) to restrict unauthorized application execution.
   • Monitor for suspicious BITS job creation and file writes to unexpected locations.
3. Workarounds: There is no known official workaround that disables the vulnerability without impacting BITS functionality. Patching is the definitive remediation.

Detection

Defenders can monitor for the following indicators:

• BITS Job Audits: Enable and review Windows Event Log entries for BITS job creation (Event ID 59 in the BITS-Client operational log).
• Symbolic Link Creation: Monitor for symbolic link creation in user-writable directories that target system directories.
• Unexpected File Writes: Alert on file writes by svchost.exe (BITS service host) to unusual paths outside standard download directories.
• Process Monitoring: Look for low-privilege processes creating BITS jobs that result in writes to protected directories.

Assessment

With an EPSS score of 0.42524 (98.5th percentile), this vulnerability is in the top tier of exploitation probability. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog since January 2022 confirms active, real-world exploitation. This should be treated as an imminent threat in environments with unpatched systems.

Key Lessons:

1. Symbolic links remain a critical attack surface on Windows. Services running with elevated privileges must validate and resolve links before performing file operations.
2. Patch velocity matters: The vulnerability was disclosed in March 2020 but remains relevant years later in environments with poor patch hygiene. CISA KEV inclusion should trigger immediate remediation.

References

• http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0787