CVE-2020-0787
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
Description
CVE-2020-0787 is a HIGH severity privilege escalation vulnerability in the Microsoft Windows Background Intelligent Transfer Service (BITS), classified under CWE-59 (Improper Link Resolution Before File Access). The flaw exists because BITS improperly handles symbolic links during file operations, allowing a local attacker to escalate privileges to SYSTEM level and execute arbitrary code. With a CVSS 3.1 score of 7.8, the vulnerability affects a wide range of Windows versions including Windows 7, Windows 8.1, Windows 10 (multiple builds), and Windows Server editions from 2008 through 2019. CISA added CVE-2020-0787 to its KEV catalog on January 28, 2022, and it has confirmed associations with ransomware campaigns. The EPSS score of 0.58819 (98.19th percentile) indicates a very high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows 10 1909 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 1909 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0787(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access, commonly known as a symlink attack or link-following vulnerability, occurs when software accesses a file using a path that can be manipulated by an attacker through the creation or modification of symbolic links, hard links, or junctions. The vulnerability arises when a privileged application follows a symbolic link without verifying that the link points to an intended and authorized file location. This is especially dangerous when the application operates with elevated privileges, as the attacker can redirect file operations to target sensitive system files they would not normally have permission to access, modify, or delete.
In the context of CVE-2020-0787, the Windows Background Intelligent Transfer Service (BITS) processes file operations during background data transfers. BITS runs as a system service with elevated privileges and handles file moves and renames as part of its job completion workflow. The vulnerability arises because BITS does not properly validate symbolic links during these file operations, allowing a local attacker to create specially crafted junctions or symlinks that redirect BITS file operations to arbitrary locations on the filesystem. When BITS completes a transfer and moves files to their final destination, it follows the attacker-created symbolic link with SYSTEM-level privileges, effectively writing attacker-controlled content to any location on the system. Learn more about Link Following (CWE-59)
Impact Analysis
CVE-2020-0787 carries a CVSS 3.1 base score of 7.8 (HIGH) with locally exploitable attack characteristics.
Confidentiality (High): Successful exploitation grants SYSTEM-level privileges on the affected Windows host. This provides unrestricted access to all data on the system, including password hashes from the SAM database, cached domain credentials, encryption keys, user documents, email stores, and any other sensitive data stored locally. The attacker can also access network resources available to the SYSTEM account, potentially expanding the scope of data exposure.
Integrity (High): With SYSTEM privileges, the attacker can modify any file on the system, including protected operating system files, security configurations, registry entries, and installed applications. This enables the installation of rootkits, backdoors, and persistent malware that survives reboots. The attacker can also manipulate audit logs to conceal evidence of the compromise and modify Group Policy settings to weaken security across the domain.
Availability (High): SYSTEM-level access allows the attacker to disrupt any service running on the host, delete critical system files, encrypt filesystems with ransomware, or render the system completely inoperable. Given the confirmed ransomware association, this availability impact has materialized in real-world attacks where the privilege escalation was used to deploy ransomware payloads.
Scope (Unchanged): The scope remains unchanged as the vulnerability affects the same security context (the Windows host). However, SYSTEM-level access on a domain-joined machine frequently enables lateral movement to other systems. The EPSS score of 0.58819 (98.19th percentile) confirms a very high real-world exploitation probability.
Exploit Maturity
Active Exploitation: CVE-2020-0787 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on January 28, 2022, with a mandatory remediation deadline of July 28, 2022 for federal agencies. The vulnerability is a favored post-initial-access tool for threat actors who have already gained a foothold on a target system.
Ransomware Association: CISA's KEV catalog explicitly confirms that CVE-2020-0787 is associated with known ransomware campaigns. Ransomware operators exploit this privilege escalation vulnerability to gain SYSTEM-level access required to disable security software, access protected files, and deploy ransomware payloads across the filesystem.
Public Exploits: A public exploit for this vulnerability is available on Packet Storm Security as Background Intelligent Transfer Service Privilege Escalation. The detailed exploit code lowers the barrier for exploitation by less sophisticated threat actors.
EPSS Context: The EPSS score of 0.58819 (98.19th percentile) places this vulnerability in the top 2% of all CVEs for exploitation probability, consistent with the confirmed ransomware associations and public exploit availability.
KEV Deadline: Federal agencies were required to apply remediation by July 28, 2022. Given the ransomware association, all organizations should prioritize patching affected Windows systems.
Remediation
-
Apply Microsoft security updates immediately. Install the security patches provided through Windows Update or the Microsoft Security Response Center advisory for CVE-2020-0787. The update corrects how BITS handles symbolic links during file operations.
-
Prioritize patching based on ransomware risk. Due to the confirmed ransomware association, prioritize this patch on systems that are most critical to operations or that store sensitive data. Systems already exposed to other vulnerabilities that could provide initial access should receive the highest priority.
-
Audit systems for indicators of compromise. Search for evidence of symlink exploitation in BITS job logs and Windows Event Logs. Look for suspicious BITS jobs, unexpected file operations in privileged directories, and signs of privilege escalation such as new services or scheduled tasks created under the SYSTEM context by non-administrative users.
-
Implement application control and endpoint detection. Deploy endpoint detection and response (EDR) solutions capable of detecting privilege escalation attempts involving symbolic link manipulation. Application control policies can limit which executables can run with elevated privileges and detect anomalous behavior patterns.
-
Restrict local attack surface. Ensure that local user accounts follow the principle of least privilege. Disable unnecessary local services and restrict which users can create symbolic links using the Windows security policy setting "Create symbolic links" (SeCreateSymbolicLinkPrivilege).
-
Segment networks to limit post-exploitation impact. Since ransomware operators use this vulnerability for lateral movement, implement network segmentation and micro-segmentation to contain the blast radius if a single system is compromised.
Technical Details
CVE-2020-0787 is a local privilege escalation vulnerability in the Windows Background Intelligent Transfer Service (BITS). BITS is a system service that facilitates asynchronous background file transfers, most commonly used by Windows Update, SCCM, and other Microsoft services. The service runs under the SYSTEM account and performs file move and rename operations as part of completing transfer jobs.
The vulnerability exists because BITS does not properly validate file paths during job completion when moving temporary downloaded files to their final destination. An attacker with local access creates a BITS job and manipulates the job's temporary file storage using NTFS junctions or symbolic links. When BITS completes the transfer and attempts to move the file, it follows the symbolic link with SYSTEM privileges, writing attacker-controlled content to an arbitrary file location.
The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack requires local access and some user interaction, but no privileges are required to trigger the vulnerability. The user interaction component reflects the need for the victim to initiate or interact with a BITS transfer, though in practice this requirement is minimal since BITS transfers occur frequently on Windows systems through automatic updates and other background services.
The root cause is a Time-of-Check-Time-of-Use (TOCTOU) race condition combined with improper symlink validation. BITS checks the destination path at one point in time but performs the actual file operation later, during which window the attacker can substitute a symbolic link. The exploit published on Packet Storm Security demonstrates the complete exploitation chain, including junction creation, BITS job manipulation, and privilege escalation to SYSTEM.
Frequently Asked Questions
What is CVE-2020-0787?
CVE-2020-0787 is a privilege escalation vulnerability in the Microsoft Windows Background Intelligent Transfer Service (BITS). It allows a local attacker to exploit improper symbolic link handling during file operations to escalate privileges to SYSTEM level and execute arbitrary code. The vulnerability is rated HIGH with a CVSS 3.1 score of 7.8 and has confirmed associations with ransomware campaigns.
Which Windows versions are affected by CVE-2020-0787?
CVE-2020-0787 affects a broad range of Windows versions including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (builds 1507 through 1909), Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server versions 1803, 1903, and 1909. Organizations running any of these versions without the security update are at risk.
How do I fix CVE-2020-0787?
Apply the security update from Microsoft through Windows Update or by downloading it from the Microsoft Security Response Center. After patching, audit systems for signs of prior exploitation, particularly any unexpected BITS jobs or evidence of symbolic link manipulation in privileged directories. Due to the ransomware association, treat this as a high-priority patch across all affected systems.
How severe is CVE-2020-0787?
CVE-2020-0787 is rated HIGH with a CVSS score of 7.8. While it requires local access, its EPSS score of 0.58819 (98.19th percentile) reflects very high real-world exploitation. Critically, CISA has confirmed ransomware operators actively exploit this vulnerability to escalate privileges and deploy ransomware payloads. It is listed in the Known Exploited Vulnerabilities catalog with a federal remediation deadline, underscoring its severity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.