Windows Installer Privilege Escalation via Symbolic Link Manipulation (CVE-2020-0683)

1. Vulnerability Overview & Root Cause

An elevation of privilege vulnerability exists in the Windows Installer when MSI (Microsoft Installer) packages process symbolic links and junctions. Because the Windows Installer service runs with elevated privileges (NT AUTHORITY\SYSTEM), it performs file operations on behalf of the installation process. If the service fails to properly validate whether a target path is a symbolic link controlled by an unprivileged user, it can be coerced into modifying protected system files. This vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local access to the target Windows system with low-privilege user credentials. The attacker monitors directories used by the Windows Installer for temporary or backup files (such as 'C:\Config.Msi'). During an active installation or rollback process, the attacker replaces a pending installer file with a symbolic link pointing to a critical system file (e.g., a system DLL or service executable). When the Windows Installer service attempts to write to or modify the file, it follows the link and overwrites the target system file with the attacker's payload, allowing the attacker to execute arbitrary code as SYSTEM.

3. Infrastructure & Business Impact

This vulnerability is cataloged in CISA's Known Exploited Vulnerabilities (KEV), indicating active exploitation in the wild. While it requires local access, it serves as a critical component in multi-stage attack chains. Threat actors who gain initial access via phishing or web exploits leverage this local privilege escalation (LPE) to bypass endpoint security controls, disable antivirus software, deploy ransomware, and compromise Active Directory domain controllers, resulting in severe operational disruption and data breaches.