CVE-2020-1461: Windows Defender Privilege Escalation Flaw

CVE-2020-1461 Overview

An elevation of privilege vulnerability exists in Microsoft Windows Defender when the MpSigStub.exe component improperly handles file deletion operations. This flaw allows authenticated attackers with local access to delete files in arbitrary locations on the affected system, potentially leading to system compromise or denial of service conditions.

Critical Impact

Local attackers can leverage this vulnerability to delete critical system files or security components, potentially disabling security protections or causing system instability.

Affected Products

• Microsoft Windows Defender
• Microsoft Windows 10 (all versions through 1909)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 (SP2 and R2 SP1)
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Forefront Endpoint Protection 2010
• Microsoft Security Essentials
• Microsoft System Center Endpoint Protection

Discovery Timeline

• 2020-07-14 - CVE-2020-1461 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-1461

Vulnerability Analysis

This elevation of privilege vulnerability resides in MpSigStub.exe, a signature stub utility component of Microsoft Defender and related endpoint protection products. The vulnerability stems from improper handling of file operations during signature extraction or update processes.

When MpSigStub.exe performs file deletion operations, it fails to properly validate the target file paths, allowing an authenticated local attacker to manipulate the deletion target. This can result in arbitrary file deletion with the elevated privileges of the Defender service, which typically runs as SYSTEM.

The attack requires local access and valid credentials to the target system, but does not require user interaction to exploit. An attacker who successfully exploits this vulnerability can delete files that would otherwise be protected, potentially removing critical system files, security configurations, or audit logs.

Root Cause

The root cause of this vulnerability is improper file path validation in the MpSigStub.exe component. The executable fails to adequately verify that file deletion operations target only legitimate, expected file paths within the Defender signature directories.

This allows an attacker to potentially abuse symbolic links, junction points, or other file system redirection techniques to redirect deletion operations to arbitrary locations on the file system. Since MpSigStub.exe runs with elevated privileges, these deletion operations succeed even against protected system files.

Attack Vector

The attack vector for CVE-2020-1461 requires local access to the vulnerable system. An attacker must first obtain valid credentials and log on to the target machine. Once authenticated, the attacker can:

1. Create symbolic links or junction points that redirect file operations
2. Trigger or wait for MpSigStub.exe to perform file cleanup operations
3. The deletion operation follows the redirection and deletes the attacker-specified target file

This technique is commonly known as an "arbitrary file delete" primitive, which can be leveraged to escalate privileges by deleting critical security components or creating conditions for further exploitation.

Detection Methods for CVE-2020-1461

Indicators of Compromise

• Unexpected file deletion events originating from MpSigStub.exe process
• Creation of symbolic links or junction points in Windows Defender signature directories
• Suspicious process activity involving MpSigStub.exe with unusual file system operations
• Missing or deleted critical system files without legitimate explanation

Detection Strategies

• Monitor for symbolic link or junction point creation in Defender-related directories such as %ProgramData%\Microsoft\Windows Defender
• Implement file integrity monitoring on critical system files and security configurations
• Enable Windows Security Event logging for file system operations (Event ID 4663)
• Deploy behavioral detection rules for privilege escalation attempts involving Microsoft Defender components

Monitoring Recommendations

• Configure SentinelOne agents to monitor for suspicious file operations by MpSigStub.exe
• Enable auditing of object access on sensitive directories and system files
• Implement alerting for unexpected deletion of protected files or security components
• Review Windows Defender operational logs for anomalous signature update activities

How to Mitigate CVE-2020-1461

Immediate Actions Required

• Apply the latest security updates from Microsoft for Windows Defender and affected operating systems
• Ensure Microsoft Defender definitions are current, as the fix may be delivered through definition updates
• Review systems for signs of compromise before patching
• Implement least privilege access controls to limit local user capabilities

Patch Information

Microsoft has released security updates to address this vulnerability. The patch corrects how MpSigStub.exe handles file deletion operations by implementing proper path validation and preventing redirection attacks.

For detailed patch information and download links, refer to the Microsoft Security Advisory CVE-2020-1461.

Organizations using Microsoft endpoint protection products should ensure automatic updates are enabled to receive the fix automatically.

Workarounds

• Restrict local logon access to trusted administrators only until patches can be applied
• Implement application control policies to prevent unauthorized execution of tools that create symbolic links
• Enable Protected Process Light (PPL) for antimalware processes where supported
• Monitor and alert on any modifications to Windows Defender directories

# Verify Windows Defender is updated with latest definitions
# Run in elevated PowerShell
Get-MpComputerStatus | Select-Object AntivirusSignatureLastUpdated, AMProductVersion, AMEngineVersion

# Check for pending Windows updates related to Defender
Get-WindowsUpdate -KBArticleID "KB*" | Where-Object {$_.Title -like "*Defender*"}