CVE-2017-0213
Microsoft Windows Privilege Escalation Vulnerability
Description
CVE-2017-0213 is a privilege escalation vulnerability in the Windows COM Aggregate Marshaler that allows a locally authenticated attacker to execute arbitrary code with elevated privileges by exploiting the way Windows handles COM objects. The vulnerability can be triggered by running a specially crafted application that manipulates COM object instantiation to bypass security restrictions. CISA added CVE-2017-0213 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation. With an EPSS score of 96.8% (99.8th percentile), this is one of the most heavily exploited Windows privilege escalation vulnerabilities, with widespread use in post-compromise toolkits.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98102(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038457(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/42020/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0213(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privileges, allowing attackers to gain unauthorized elevated access. In CVE-2017-0213, the Windows COM Aggregate Marshaler improperly handles COM object type coercion, allowing a local attacker to bypass intended privilege restrictions and execute code with elevated permissions.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2017-0213 enables local privilege escalation on affected Windows systems through the COM Aggregate Marshaler, allowing an attacker to gain administrative or SYSTEM-level access from a standard user account. The vulnerability impacts a broad range of Windows versions, including Windows 7 through Windows 10 and Windows Server 2008 through 2016, making it a ubiquitous threat across enterprise environments. Successful exploitation allows the attacker to install programs, view or change data, and create new accounts with full user rights, effectively providing complete local system control. The 99.8th percentile EPSS score and confirmed KEV listing demonstrate that this vulnerability is extensively used in real-world attacks, particularly as a reliable privilege escalation step in multi-stage intrusions.
Exploit Maturity
CVE-2017-0213 has extremely mature exploit availability, with multiple public proof-of-concept exploits and compiled binaries available on GitHub and integrated into penetration testing frameworks. The EPSS score of 96.8% (99.8th percentile) reflects near-universal exploitation activity, and CISA's KEV listing from March 28, 2022 confirms ongoing real-world use. The exploit is particularly popular in post-compromise scenarios due to its reliability and broad Windows version compatibility, making it a staple tool for both red teams and malicious actors.
Remediation
- Apply the Microsoft security update from May 2017 (Patch Tuesday) that addresses CVE-2017-0213 in the Windows COM Aggregate Marshaler across all affected Windows versions.
- Ensure all Windows systems are enrolled in automatic Windows Update to receive security patches promptly for known exploited vulnerabilities.
- Deploy endpoint detection and response (EDR) solutions that can detect COM object manipulation and privilege escalation attempts characteristic of CVE-2017-0213 exploitation.
- Implement application control policies (AppLocker or Windows Defender Application Control) to prevent execution of unauthorized executables that could attempt privilege escalation.
- Enforce the principle of least privilege to minimize the number of accounts with local logon access that could serve as privilege escalation starting points.
Technical Details
CVE-2017-0213 exploits a flaw in the Windows COM Aggregate Marshaler related to improper handling of COM object type coercion. The vulnerability exists in the way Windows marshals COM objects across apartment boundaries, where the Aggregate Marshaler fails to properly validate the type of objects being instantiated. An attacker can craft a specially designed application that leverages this type confusion to instantiate COM objects with elevated privileges, bypassing the normal COM security model. The attack requires local code execution and can be triggered by running a malicious executable as a standard user, which then gains elevated privileges through the COM marshaling flaw.
Frequently Asked Questions
Is CVE-2017-0213 being actively exploited?
Yes, CVE-2017-0213 is extensively exploited in the wild. CISA added it to the KEV catalog on March 28, 2022, and the EPSS score of 96.8% (99.8th percentile) confirms near-universal exploitation activity. Multiple public exploit tools are available and widely used in both legitimate penetration testing and malicious operations.
What systems are affected by CVE-2017-0213?
CVE-2017-0213 affects a broad range of Windows versions including Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. Any unpatched system running these versions is vulnerable.
How do I fix CVE-2017-0213?
Apply the Microsoft security update from the May 2017 Patch Tuesday release. Ensure all systems are enrolled in automatic Windows Update. Deploy application control policies and EDR solutions to detect and prevent exploitation attempts.
How severe is CVE-2017-0213?
CVE-2017-0213 is a high-severity local privilege escalation vulnerability with an EPSS score in the 99.8th percentile, indicating near-universal exploitation. Its reliability, broad Windows version compatibility, and availability of public exploits make it one of the most commonly used privilege escalation tools in the Windows ecosystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.