CVE-2019-1385
Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability
Description
CVE-2019-1385 is a privilege escalation vulnerability in the Windows AppX Deployment Extensions that improperly performs privilege management, resulting in unauthorized access to system files. This vulnerability allows a local attacker to escalate their privileges and gain access to protected system resources. CISA has confirmed active exploitation and included CVE-2019-1385 in the Known Exploited Vulnerabilities (KEV) catalog with a known ransomware association. With an EPSS percentile of 59.0%, the ransomware connection elevates the urgency of remediation despite the moderate exploitation probability score.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1385(Patch, Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-19-979/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1385(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes weaknesses where a product does not properly assign, modify, track, or check privileges, allowing an actor to gain more access than intended. In CVE-2019-1385, the Windows AppX Deployment Extensions fail to correctly manage privilege boundaries during application deployment operations, enabling a local attacker to access system files that should be restricted to higher-privilege processes.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2019-1385 is a local privilege escalation vulnerability in the Windows AppX Deployment Extensions that grants an attacker access to protected system files through improper privilege management. The vulnerability requires local access to the target system, meaning an attacker must first establish a foothold through another attack vector. Once exploited, the attacker gains access to system files that are normally protected from standard user accounts, which can include system configuration files, security policy settings, and credential stores. The confirmed ransomware association in the CISA KEV catalog makes this vulnerability particularly concerning — ransomware operators use privilege escalation to disable security software, encrypt system-critical files, and maximize the impact of their attacks. The EPSS percentile of 59.0% indicates moderate exploitation probability, but the ransomware connection means organizations should treat remediation as a high priority regardless of the EPSS score.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-1385 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The KEV catalog explicitly flags this vulnerability with a known ransomware association, indicating that ransomware operators have incorporated this privilege escalation into their attack toolkits. The EPSS percentile of 59.0% indicates moderate exploitation probability overall, but the ransomware usage confirms that sophisticated threat actors are actively leveraging this vulnerability. Privilege escalation vulnerabilities in Windows deployment components like AppX are particularly valuable in ransomware campaigns because they provide the elevated access needed to disable endpoint protection, access encrypted credential stores, and deploy ransomware payloads across the system.
Remediation
- Apply the security updates provided by Microsoft for the Windows AppX Deployment Extensions component. CISA mandates remediation by June 13, 2022.
- Given the ransomware association, prioritize patching on systems that store critical business data, backup infrastructure, and domain controllers where ransomware deployment would have the most devastating impact.
- Restrict the AppX Deployment Extensions service to only authorized administrative accounts and monitor for unauthorized usage of AppX deployment functionality by standard user accounts.
- Deploy endpoint detection and response (EDR) solutions with specific detection rules for privilege escalation via Windows deployment subsystems, including anomalous file access to system-protected directories.
- Maintain isolated, offline backups of all critical data and test restoration procedures regularly to ensure ransomware resilience, as the confirmed ransomware association makes robust backup practices essential.
Technical Details
CVE-2019-1385 exploits a privilege management flaw in the Windows AppX Deployment Extensions, a component responsible for handling the deployment and installation of Windows application packages (AppX/MSIX). The vulnerability arises when this component improperly manages privilege levels during file operations associated with application deployment. Specifically, the AppX Deployment Extensions perform certain file system operations with elevated privileges without properly validating that the requesting process has sufficient authorization, or without adequately restricting the file paths that can be accessed through these operations. A local attacker can exploit this behavior to trick the deployment component into accessing or modifying system-protected files on the attacker's behalf — a technique known as a privileged file operation abuse or junction/symlink attack. By creating symbolic links or junction points that redirect the deployment component's file operations to system-critical locations, the attacker gains read or write access to files that would normally be inaccessible from their privilege level.
Frequently Asked Questions
Is CVE-2019-1385 being actively exploited?
Yes, CVE-2019-1385 is being actively exploited, with confirmed ransomware usage. CISA has included it in the KEV catalog with a known ransomware association and an EPSS percentile of 59.0%. The ransomware connection makes immediate remediation essential.
What products are affected by CVE-2019-1385?
CVE-2019-1385 affects the Windows AppX Deployment Extensions in Microsoft Windows. Multiple Windows versions are impacted. Administrators should consult Microsoft's security advisory for the specific list of affected operating system versions.
How do I fix CVE-2019-1385?
Apply Microsoft's security updates for the affected Windows versions. Prioritize patching on systems storing critical data and backup infrastructure. Deploy EDR solutions and maintain offline backups to mitigate the ransomware risk associated with this vulnerability.
How severe is CVE-2019-1385?
CVE-2019-1385 is a privilege escalation vulnerability with confirmed ransomware association. While the EPSS percentile of 59.0% suggests moderate exploitation probability, the ransomware usage significantly elevates the threat. Organizations should treat this as a high-priority remediation target to prevent ransomware attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.