CVE-2020-0787: Windows 10 Privilege Escalation Vulnerability

CVE-2020-0787 Overview

CVE-2020-0787 is an elevation of privilege vulnerability in the Windows Background Intelligent Transfer Service (BITS). The service improperly handles symbolic links, allowing a local attacker to manipulate file system operations performed by a privileged process. Successful exploitation grants the attacker SYSTEM-level privileges on the affected host. The flaw is classified under CWE-59: Improper Link Resolution Before File Access and affects nearly every supported Windows client and server version at the time of disclosure. CISA added CVE-2020-0787 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.

Critical Impact
A local, authenticated attacker can abuse BITS symbolic link handling to overwrite arbitrary files as NT AUTHORITY\SYSTEM, achieving full local privilege escalation across all supported Windows releases.

Affected Products

Microsoft Windows 7 SP1, Windows 8.1, Windows RT 8.1
Microsoft Windows 10 (versions 1507, 1607, 1709, 1803, 1809, 1903, 1909)
Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, and Server versions 1803/1903/1909

Discovery Timeline

2020-03-12 - CVE-2020-0787 published to the National Vulnerability Database
2020-03-12 - Microsoft releases security patch via the March 2020 Patch Tuesday cycle
2025-10-29 - Last updated in NVD database

Technical Details for CVE-2020-0787

Vulnerability Analysis

The Windows Background Intelligent Transfer Service (BITS) runs as LocalSystem and is responsible for asynchronous file transfers used by Windows Update, SCCM, and many third-party applications. BITS maintains a job state database and performs file operations on behalf of the requesting user. The vulnerability stems from BITS following symbolic links and NTFS junctions without validating that the resolved target is appropriate for the caller's security context. An unprivileged user can craft BITS jobs that manipulate file paths through reparse points, causing the privileged service to perform file operations on attacker-chosen locations. This is a classic file system symlink attack [CWE-59] and falls into the broader category of TOCTOU-style privilege escalation flaws.

Root Cause

BITS performs file move and rename operations during job state transitions, including restoration of in-progress transfers across service restarts. The service did not adequately canonicalize destination paths or impersonate the requesting user before resolving reparse points. An attacker who plants a junction in a user-writable directory can redirect a privileged BITS file operation to a protected system location.

Attack Vector

Exploitation requires local code execution as a standard user. The attacker creates a BITS job, terminates or interrupts it to force state recovery, and uses NTFS junctions or object manager symbolic links to redirect the resulting file operation. Public exploit code, including the proof-of-concept published on Packet Storm, abuses the BITS recovery path to write attacker-controlled content into a SYSTEM-owned file. The result is arbitrary file overwrite as LocalSystem, which can be chained into DLL hijacking or service binary replacement for full privilege escalation.

No verified code example is reproduced here. See the Packet Storm advisory and the Microsoft Security Advisory CVE-2020-0787 for technical details.

Detection Methods for CVE-2020-0787

Indicators of Compromise

Creation of NTFS junction points or reparse points in user-writable directories such as %TEMP%, %LOCALAPPDATA%, or BITS working paths immediately before BITS job activity.
Unexpected BITS job creation, cancellation, or repeated state transitions by non-administrative users, visible in the Microsoft-Windows-Bits-Client/Operational event log.
Modification of files under C:\Windows\System32\ or service binary paths with a timestamp that correlates with svchost.exe hosting the BITS service.

Detection Strategies

Hunt for processes spawned by svchost.exe -k netsvcs (the BITS host) performing file writes to paths outside expected BITS staging locations.
Alert on use of bitsadmin.exe or PowerShell Start-BitsTransfer with local file destinations followed by abnormal SYSTEM-context file modifications.
Correlate reparse point creation events (Sysmon Event ID 11 with reparse attributes, or file system minifilter telemetry) with subsequent BITS activity from the same user session.

Monitoring Recommendations

Enable and forward Microsoft-Windows-Bits-Client/Operational and Microsoft-Windows-Bits-Client/Analytic logs to a central SIEM for retention and correlation.
Monitor child process creation under svchost.exe and any new auto-start service binaries written after BITS activity.
Baseline normal BITS usage in your environment so that abnormal job volumes from non-administrative accounts trigger investigation.

How to Mitigate CVE-2020-0787

Immediate Actions Required

Apply the March 2020 Microsoft security update referenced in the Microsoft Security Advisory CVE-2020-0787 to all affected Windows clients and servers.
Prioritize patching on multi-user systems, terminal servers, jump hosts, and developer workstations where local code execution by standard users is most likely.
Verify patch deployment status against the CISA Known Exploited Vulnerabilities catalog entry and remediate any remaining hosts.

Patch Information

Microsoft addressed CVE-2020-0787 in the March 10, 2020 security updates. The fix modifies BITS to properly impersonate the caller and validate path resolution before performing privileged file operations. Refer to the Microsoft Security Response Center advisory for the KB article corresponding to each Windows build.

Workarounds

No supported workaround replaces patching; disabling the BITS service breaks Windows Update, Microsoft Defender signature delivery, and many management agents.
If patching must be deferred, restrict interactive logon on affected hosts and remove unnecessary local accounts to reduce the local attack surface.
Enforce application control (Windows Defender Application Control or AppLocker) to block execution of unauthorized binaries that would deliver the local exploit.

bash

# Verify BITS service status and confirm patch level on a Windows host
sc.exe query BITS
wmic qfe list brief | findstr /i "KB4540673 KB4538461 KB4541510 KB4540689"
# Replace KB numbers with the specific update applicable to your Windows build
# per the Microsoft advisory for CVE-2020-0787.