CVE-2020-0787

What is BITS?

Background Intelligent Transfer Service (BITS) is a Windows component used to transfer files asynchronously in the background — most visibly for downloading Windows Updates, but also used by many third-party applications to move files without blocking the user's foreground work. It runs with significant system privileges to do this reliably even when a user isn't logged in.

Overview

CVE-2020-0787 is a privilege-escalation vulnerability (CWE-59, improper link resolution before file access) in BITS. Because BITS improperly handles symbolic links during certain file operations, a local low-privileged attacker can manipulate it into performing a privileged file operation on an attacker-chosen target instead of the intended one, ultimately executing arbitrary code with SYSTEM-level privileges (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High).

Technical Details

The vulnerability follows a well-known Windows local-privilege-escalation pattern: a privileged service (BITS) performs a file operation on a path, but fails to verify that the path hasn't been swapped out for a symbolic link pointing somewhere else between the time it's checked and the time it's used. An attacker can exploit this race to redirect a privileged file operation to an arbitrary location, using BITS's elevated context to write, move, or overwrite files a standard user account couldn't normally touch — ultimately leveraging that capability for full SYSTEM code execution.

Discovery

Patched as part of Microsoft's routine March 2020 Patch Tuesday release.

Exploitation Context

This CVE's ransomwareUse: true flag on this site reflects confirmed use by ransomware operators as a post-compromise privilege-escalation tool — a common pattern where an attacker who has already gained initial low-privilege access to a Windows endpoint uses a local EoP bug like this one to reach SYSTEM and deploy ransomware with maximum impact and reach across the host.

Remediation

1. Apply Microsoft's March 2020 Patch Tuesday update immediately if not already installed.
2. Deploy endpoint detection capable of identifying anomalous BITS activity and symbolic link abuse techniques, given this vulnerability's confirmed use in ransomware intrusion chains.
3. Restrict local administrative rights for standard users where possible, reducing the population of accounts that could exploit a local privilege-escalation bug.
4. Treat any endpoint where this patch was missing as a higher-priority target for compromise assessment, particularly if other signs of intrusion are present.