CVE-2020-16852: OneDrive for Windows Elevation of Privilege Vulnerability
CVE-2020-16852 is an elevation of privilege vulnerability in OneDrive for Windows, rated Important by Microsoft, with a CVSS 3.0 base score of 7.1 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.93% probability of exploitation activity in the next 30 days, higher than 61% of all scored vulnerabilities. Microsoft released the fix on 8 September 2020 in the September 2020 Patch Tuesday. It affects 1 product in 1 product family (Other).
Key facts
- CVE ID
- CVE-2020-16852
- Severity
- High CVSS 7.1
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- EPSS
- 0.93% (percentile 61%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- September 2020 Patch Tuesday
- Product families
- Other
CVSS score and vector
Microsoft scores CVE-2020-16852 at 7.1 (temporal 6.4) using CVSS 3.0. Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Proof of concept |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 7.1 (HIGH) with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Description
An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could overwrite a targeted file with an elevated status.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete a targeted file with an elevated status.
The update addresses this vulnerability by correcting where the OneDrive updater performs file writes while running with elevation.
Frequently asked questions (Microsoft)
Do I need to take any action to protect myself from this vulnerability?
Most customers have been protected from this vulnerability because OneDrive has its own updater that periodically checks and updates the OneDrive binary. If your network is air-gapped, you can update the binary from the link in the Security Updates table.
In which situations does this vulnerability apply?
This vulnerability only applies when OneDrive is installed per machine and does not apply to the default per user install. Please see Per Machine Installation for more information.
Which release contains the updates to protect against the vulnerability?
20.170.0824.0001 is the minimum version. The version and all new versions are protected from this vulnerability.
Does 20.201.1005.0006 include the protection for CVE-2020-16853?
Yes, this version does protect against this vulnerability.
Affected products (1)
Other
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| 11752 | Release Notes | Security Update | Maybe |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 7.1 (HIGH)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| onedrive | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16852 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16852 (Patch, Vendor Advisory)
Acknowledgments
- Zhiniang Peng (@edwardzpeng) and Fangming Gu (@afang5472)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |