Zero-Day Advisory
Fortinet Discovers Microsoft Windows AppX Deployment Server Elevation of Privilege
Summary
Fortinet's FortiGuard Labs has discovered a local privilege escalation in Microsoft Windows Appx Deployment Service (AppXSvc)
Microsoft Windows Appx Deployment Server is a default Windows 10 service that is responsible to provide infrastructure support for deploying Windows Store applications.
The local elevation of privilege happens when an attacker creates bogus symbolic link for predictable files and folders created by AppXSvc that allows unprivileged users overwrite discretionary access control of escalated files.
Solutions
FortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:MS.RPC.AppXSvc.Privilege.Escalation
Released Jan 08, 2019
Users should apply the solution provided by Microsoft.
Timeline
Fortinet reported the vulnerability to Microsoft on November 08, 2018.
Microsoft confirmed the vulnerability on December 04, 2018.
Microsoft patched the vulnerability on March 13, 2019.