CVE-2020-1112: Windows 10 BITS Privilege Escalation Flaw

CVE-2020-1112 Overview

CVE-2020-1112 is a critical elevation of privilege vulnerability affecting the Windows Background Intelligent Transfer Service (BITS) IIS module. The vulnerability exists due to improper handling of uploaded content by the BITS IIS module, which can allow an authenticated attacker to escalate privileges on the target system. BITS is a Windows component used to transfer files asynchronously between machines using idle network bandwidth, commonly utilized by Windows Update and other Microsoft services.

Critical Impact

An attacker who successfully exploits this vulnerability could gain elevated privileges on affected Windows systems, potentially achieving full system compromise with the ability to install programs, view/change/delete data, or create new accounts with full user rights.

Affected Products

• Microsoft Windows 10 (multiple versions including 1607, 1709, 1803, 1809, 1903, 1909)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019

Discovery Timeline

• May 21, 2020 - CVE-2020-1112 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-1112

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), indicating that the BITS IIS module fails to properly validate or sanitize uploaded content. The flaw exists in how the BITS extension for IIS processes file uploads, which can be abused by a low-privileged authenticated user to execute arbitrary operations with elevated privileges.

The vulnerability has a Changed Scope, meaning successful exploitation affects resources beyond the vulnerable component's security scope. An attacker with low privileges can leverage this flaw to potentially compromise the confidentiality, integrity, and availability of the entire system. The network-based attack vector with low complexity makes this vulnerability particularly dangerous in enterprise environments where BITS IIS extensions are deployed.

Root Cause

The root cause of CVE-2020-1112 lies in the improper handling of uploaded content within the BITS IIS module. Specifically, the module fails to adequately validate file uploads, allowing attackers to bypass security restrictions intended to prevent unauthorized privilege escalation. The BITS Server Extension for IIS does not properly enforce access controls or content validation when processing upload requests, creating an opportunity for exploitation.

Attack Vector

The attack can be conducted remotely over the network by an authenticated user with low privileges. The exploitation flow involves:

1. An attacker authenticates to a Windows system running IIS with the BITS Server Extension enabled
2. The attacker crafts malicious upload requests targeting the BITS IIS module
3. Due to improper content handling, the uploaded content is processed with elevated privileges
4. The attacker gains elevated access, potentially achieving SYSTEM-level privileges

The vulnerability does not require user interaction beyond initial authentication, and the attack complexity is low, making it accessible to attackers without specialized technical knowledge.

Detection Methods for CVE-2020-1112

Indicators of Compromise

• Unusual file upload activity targeting BITS IIS endpoints, particularly from low-privileged accounts
• Unexpected process spawning by IIS worker processes (w3wp.exe) with elevated privileges
• Anomalous BITS-related activity in Windows Event Logs, specifically events related to BITS Server Extension
• Privilege escalation attempts following web requests to IIS servers with BITS extensions enabled

Detection Strategies

• Monitor IIS logs for suspicious requests to BITS upload endpoints with unusual content types or sizes
• Implement SIEM rules to correlate low-privilege user authentication with subsequent privileged operations
• Deploy endpoint detection solutions to identify privilege escalation patterns originating from IIS processes
• Enable and monitor Windows Security Event ID 4688 (Process Creation) for anomalous child processes of w3wp.exe

Monitoring Recommendations

• Configure enhanced IIS logging to capture detailed request information for BITS endpoints
• Establish baseline behavior for BITS IIS module activity and alert on deviations
• Implement file integrity monitoring on directories used by BITS for file transfers
• Enable Windows Advanced Audit Policy for object access and privilege use events

How to Mitigate CVE-2020-1112

Immediate Actions Required

• Apply Microsoft security updates addressing CVE-2020-1112 immediately on all affected systems
• If patching is not immediately possible, consider disabling the BITS Server Extension for IIS as a temporary measure
• Review and restrict access to IIS servers with BITS extensions to only necessary users
• Audit existing systems for signs of exploitation prior to patching

Patch Information

Microsoft has released security updates to address this vulnerability as part of their May 2020 security release. Organizations should apply the appropriate patch for their Windows version as outlined in the Microsoft Security Advisory CVE-2020-1112. The patches address the improper content handling in the BITS IIS module by implementing proper validation and access control mechanisms.

Workarounds

• Disable the BITS Server Extension for IIS if not required for business operations
• Implement network segmentation to limit access to IIS servers with BITS extensions from untrusted networks
• Apply principle of least privilege to restrict which accounts can authenticate to affected servers
• Deploy web application firewalls (WAF) to filter suspicious upload requests targeting BITS endpoints

# Disable BITS Server Extension for IIS (if not required)
# Run in elevated PowerShell

# Check if BITS Server Extension is installed
Get-WindowsFeature -Name BITS-IIS-Ext

# Disable BITS Server Extension
Disable-WindowsOptionalFeature -Online -FeatureName "BITS-IIS-Ext" -NoRestart

# Alternatively, remove the BITS IIS module from specific sites
Remove-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "system.webServer/modules" -Name "." -AtElement @{name='BITSServerExtensionsISAPI'}