Windows AppX Deployment Service (AppXSVC) Hard Link Improper Handling Local Elevation of Privilege Vulnerability (CVE-2019-1130)

1. Vulnerability Overview & Root Cause

An elevation of privilege (EoP) vulnerability exists in the Windows AppX Deployment Service (AppXSVC) due to improper handling of hard links. AppXSVC runs with elevated SYSTEM privileges to manage the installation and deployment of AppX packages. The root cause lies in the service's failure to properly validate file paths and hard links when performing file operations on user-controlled directories, allowing a low-privileged user to redirect file operations to protected system locations.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, a local attacker with standard user privileges creates a hard link pointing from a directory where AppXSVC performs file operations to a target system file (such as a critical system DLL or configuration file). When AppXSVC executes a deployment task, it follows the hard link and modifies or overwrites the target file under SYSTEM privileges. This allows the attacker to replace legitimate system binaries with malicious ones, resulting in arbitrary code execution as SYSTEM.

3. Infrastructure & Business Impact

As this vulnerability is listed in the CISA KEV catalog, it has been actively exploited in the wild. Successful exploitation allows an attacker who has gained initial access to elevate their privileges to SYSTEM, bypass security controls, establish persistence, and facilitate lateral movement across the enterprise network, posing a severe threat to business operations and data confidentiality.