Fortinet Discovers Microsoft Windows AppX Deployment Server Elevation of Privilege
Fortinet's FortiGuard Labs has discovered a local privilege escalation in Microsoft Windows Appx Deployment Service (AppXSvc)
Microsoft Windows Appx Deployment Server is a default Windows 10 service that is responsible to provide infrastructure support for deploying Windows Store applications.
The local elevation of privilege happens when an attacker creates bogus symbolic link for predictable files and folders created by AppXSvc that allows unprivileged users overwrite discretionary access control of escalated files.
SolutionsFortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:
Released Jan 08, 2019
Users should apply the solution provided by Microsoft.
Fortinet reported the vulnerability to Microsoft on November 08, 2018.
Microsoft confirmed the vulnerability on December 04, 2018.
Microsoft patched the vulnerability on March 13, 2019.
This vulnerability was discovered by Wayne Low of Fortinet's FortiGuard Labs.