CVE-2020-1112: Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability
CVE-2020-1112 is an elevation of privilege vulnerability in Windows Background Intelligent Transfer Service, rated Important by Microsoft, with a CVSS 3.0 base score of 8.5 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 3.29% probability of exploitation activity in the next 30 days, higher than 89% of all scored vulnerabilities. Microsoft released the fix on 12 May 2020 in the May 2020 Patch Tuesday, delivered through 14 security updates (KB4556807, KB4551853, KB4556799, KB4556812 and more). It affects 41 products in 2 product families (Windows, ESU).
Key facts
- CVE ID
- CVE-2020-1112
- Severity
- High CVSS 8.5
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-434
- EPSS
- 3.29% (percentile 89%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2020 Patch Tuesday
- Product families
- Windows, ESU
CVSS score and vector
Microsoft scores CVE-2020-1112 at 8.5 (temporal 7.6) using CVSS 3.0. Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 8.5 (HIGH) with CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Description
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) IIS module improperly handles uploaded content. An attacker who successfully exploited this vulnerability could upload restricted file types to an IIS-hosted folder.
To exploit this vulnerability, an attacker would require permissions to upload files via BITS. An attacker could then submit a specially crafted request to upload a file.
The security update addresses the vulnerability by correcting how Windows BITS validates file names.
Affected products (41)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows 10 Version 1803 for 32-bit Systems | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1803 for x64-based Systems | KB4556807 | Security Update | Yes | |
| Windows Server, version 1803 (Server Core Installation) | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1803 for ARM64-based Systems | KB4556807 | Security Update | Yes | |
| Windows 10 Version 1809 for 32-bit Systems | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1809 for x64-based Systems | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1809 for ARM64-based Systems | KB4551853 | Security Update | Yes | |
| Windows Server 2019 | KB4551853 | Security Update | Yes | |
| Windows Server 2019 (Server Core installation) | KB4551853 | Security Update | Yes | |
| Windows 10 Version 1909 for 32-bit Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1909 for x64-based Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1909 for ARM64-based Systems | KB4556799 | Security Update | Yes | |
| Windows Server, version 1909 (Server Core installation) | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1709 for 32-bit Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1709 for x64-based Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1709 for ARM64-based Systems | KB4556812 | Security Update | Yes | |
| Windows 10 Version 1903 for 32-bit Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1903 for x64-based Systems | KB4556799 | Security Update | Yes | |
| Windows 10 Version 1903 for ARM64-based Systems | KB4556799 | Security Update | Yes | |
| Windows Server, version 1903 (Server Core installation) | KB4556799 | Security Update | Yes | |
| Windows 10 for 32-bit Systems | KB4556826 | Security Update | Yes | |
| Windows 10 for x64-based Systems | KB4556826 | Security Update | Yes | |
| Windows 10 Version 1607 for 32-bit Systems | KB4556813 | Security Update | Yes | |
| Windows 10 Version 1607 for x64-based Systems | KB4556813 | Security Update | Yes | |
| Windows Server 2016 | KB4556813 | Security Update | Yes | |
| Windows Server 2016 (Server Core installation) | KB4556813 | Security Update | Yes | |
| Windows 8.1 for 32-bit systems | KB4556846 KB4556853 | Monthly Rollup Security Only | Yes Yes | |
| Windows 8.1 for x64-based systems | KB4556846 KB4556853 | Monthly Rollup Security Only | Yes Yes | |
| Windows RT 8.1 | KB4556846 | Monthly Rollup | Yes |
ESU
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows 7 for 32-bit Systems Service Pack 1 | KB4556836 KB4556843 | Monthly Rollup Security Only | Yes Yes | |
| Windows 7 for x64-based Systems Service Pack 1 | KB4556836 KB4556843 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 for 32-bit Systems Service Pack 2 | KB4556860 KB4556854 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | KB4556860 KB4556854 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 for x64-based Systems Service Pack 2 | KB4556860 KB4556854 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | KB4556860 KB4556854 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 | KB4556836 KB4556843 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | KB4556836 KB4556843 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2012 | KB4556840 KB4556852 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2012 (Server Core installation) | KB4556840 KB4556852 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2012 R2 | KB4556846 KB4556853 | Monthly Rollup Security Only | Yes Yes | |
| Windows Server 2012 R2 (Server Core installation) | KB4556846 KB4556853 | Monthly Rollup Security Only | Yes Yes |
Security updates (14)
- KB4556807 (Security Update)
- KB4551853 (Security Update)
- KB4556799 (Security Update)
- KB4556812 (Security Update)
- KB4556826 (Security Update)
- KB4556813 (Security Update)
- KB4556836 (Monthly Rollup)
- KB4556843 (Security Only)
- KB4556846 (Monthly Rollup)
- KB4556853 (Security Only)
- KB4556860 (Monthly Rollup)
- KB4556854 (Security Only)
- KB4556840 (Monthly Rollup)
- KB4556852 (Security Only)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 8.5 (HIGH)
- NVD weakness
- CWE-434
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 10 (x64) | all listed versions |
| windows 10 (x86) | all listed versions |
| windows 10 1607 (x64) | all listed versions |
| windows 10 1607 (x86) | all listed versions |
| windows 10 1709 | all listed versions |
| windows 10 1803 | all listed versions |
| windows 10 1809 | all listed versions |
| windows 10 1903 | all listed versions |
| windows 10 1909 | all listed versions |
| windows 7 (x64) | all listed versions |
| windows 7 (x86) | all listed versions |
| windows 8.1 (x64) | all listed versions |
| windows 8.1 (x86) | all listed versions |
| windows rt 8.1 | all listed versions |
| windows server 2008 (itanium) | all listed versions |
| windows server 2008 (x64) | all listed versions |
| windows server 2008 (x86) | all listed versions |
| windows server 2008 r2 (itanium) | all listed versions |
| windows server 2008 r2 (x64) | all listed versions |
| windows server 2012 | all listed versions |
| windows server 2012 r2 | all listed versions |
| windows server 2016 | all listed versions |
| windows server 2019 | all listed versions |
References
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |