CVE-2020-1170: Windows Defender Privilege Escalation Flaw

CVE-2020-1170 Overview

An elevation of privilege vulnerability exists in Microsoft Windows Defender that allows an authenticated local attacker to perform arbitrary file deletion on the system. This vulnerability affects the Microsoft Malware Protection Engine used by Windows Defender and other Microsoft security products. To exploit the vulnerability, an attacker would first need to log on to the system with valid credentials, after which they could leverage improper permission assignment to escalate privileges and delete arbitrary files.

Critical Impact

Local attackers with low privileges can exploit this vulnerability to delete arbitrary files on the system, potentially leading to denial of service or privilege escalation by removing critical security files. This vulnerability is distinct from CVE-2020-1163.

Affected Products

• Microsoft Windows Defender
• Microsoft Windows 10 (multiple versions: 1607, 1709, 1803, 1809, 1903, 1909)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 SP2, R2 SP1
• Microsoft Windows Server 2012, 2012 R2
• Microsoft Windows Server 2016 (1803, 1903, 1909)
• Microsoft Windows Server 2019
• Microsoft Forefront Endpoint Protection 2010
• Microsoft Security Essentials
• Microsoft System Center Endpoint Protection 2012, 2012 R2

Discovery Timeline

• 2020-06-09 - CVE-2020-1170 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-1170

Vulnerability Analysis

This elevation of privilege vulnerability stems from improper permission assignments within Microsoft Windows Defender and related security products. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), indicating that the affected software fails to properly restrict permissions on resources that should be protected.

The attack requires local access to the target system with low-level user privileges. No user interaction is required to trigger the vulnerability once an attacker has established a local session. The vulnerability affects the confidentiality, integrity, and availability of the target system, as arbitrary file deletion can be leveraged to remove critical system files, security configurations, or data.

Root Cause

The root cause of CVE-2020-1170 lies in incorrect permission assignment for critical resources within the Windows Defender service. The Microsoft Malware Protection Engine (MsMpEng.exe) runs with SYSTEM-level privileges to perform security scanning operations. However, improper access control mechanisms allow a lower-privileged user to manipulate the service's file operations, resulting in arbitrary file deletion with elevated privileges.

This type of vulnerability often manifests when privileged services perform file operations based on user-controllable input without properly validating permissions or using secure file operation methods.

Attack Vector

The attack vector for CVE-2020-1170 is local, requiring the attacker to first authenticate to the target system. Once logged in, the attacker can exploit the vulnerability through the following mechanism:

1. The attacker identifies a race condition or symbolic link opportunity in Windows Defender's file handling operations
2. By crafting specific conditions, the attacker can redirect file deletion operations performed by the SYSTEM-privileged Windows Defender service
3. The service then deletes files specified by the attacker with SYSTEM privileges
4. This can be used to remove security software configurations, critical system files, or escalate privileges by deleting files that prevent higher privilege access

Technical details and a related exploit can be found in the Packet Storm Security advisory.

Detection Methods for CVE-2020-1170

Indicators of Compromise

• Unexpected deletion of system files or security configurations in Windows Defender directories
• Suspicious symbolic link or junction point creation in directories monitored by Windows Defender
• Unusual file operation failures logged by the Windows Defender service
• Evidence of exploitation attempts in Windows Event Logs related to MsMpEng.exe file operations

Detection Strategies

• Monitor Windows Defender service (MsMpEng.exe) for unusual file deletion activities, particularly involving symbolic links
• Implement file integrity monitoring on critical system directories and Windows Defender configuration files
• Review Windows Security Event Logs for privilege escalation indicators following local authentication events
• Deploy endpoint detection rules to identify abuse of Windows Defender file operations by non-administrative users

Monitoring Recommendations

• Enable detailed logging for Windows Defender service operations and file system activities
• Configure alerts for unexpected changes to Windows Defender definitions or configuration files
• Monitor for creation of symbolic links or junction points in directories accessed by Windows Defender
• Implement SentinelOne's behavioral AI to detect privilege escalation attempts exploiting antivirus services

How to Mitigate CVE-2020-1170

Immediate Actions Required

• Apply the latest Microsoft security updates for Windows Defender and affected Windows operating systems immediately
• Verify that Windows Defender definitions are up to date via Windows Update
• Audit local user accounts and remove unnecessary local access privileges
• Monitor systems for signs of exploitation while patches are being deployed

Patch Information

Microsoft has released security updates to address this vulnerability. The patch is available through the Microsoft Security Response Center advisory for CVE-2020-1170.

Organizations should apply updates for:

• Microsoft Malware Protection Engine to version 1.1.17100.2 or later
• Windows Defender Antivirus definitions through Windows Update
• System Center Endpoint Protection and Forefront Endpoint Protection via their respective update channels

For enterprise environments, updates can be deployed through Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager.

Workarounds

• Restrict local logon access to trusted users only, as the vulnerability requires local authentication
• Implement strict application whitelisting to prevent untrusted code execution
• Use the principle of least privilege to limit which users can log on locally to sensitive systems
• Consider temporarily disabling real-time protection only on non-critical systems if patching is delayed (not recommended for production environments)

# Verify Windows Defender Engine version
Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion

# Force update Windows Defender definitions
Update-MpSignature

# Check for pending security updates
Get-WindowsUpdate -MicrosoftUpdate -Verbose