Software Engineering Institute

Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The front-end components of Task Scheduler, such as schtasks.exe, are interfaces that allow for users to view, create, and modify scheduled tasks. The back-end part of Task Scheduler is a Windows service that runs with SYSTEM privileges. One of the libraries used by the Task Scheduler service, schedsvc.dll, has a function called tsched::SetJobFileSecurityByName(), which sets permissions of job files. The permissions of the job file in the %Windir%\system32\tasks directory are modified to give the calling user full permissions to the job file that they have created.

At the point where the SetSecurityInfo() function is called, the Task Scheduler service has the NT Authority\SYSTEM security token. This means that the Task Scheduler service can give full user access permissions to files that may only be controlled by the SYSTEM or other privileged accounts.

Public proof-of-concept exploit code leverages the legacy schtasks.exe and schedsvc.dll code from Windows XP to take advantage of these high privilege levels when setting file permissions. Versions of Windows prior to Vista used job files in the %Windir%\tasks directory. Legacy versions of schtasks.exe will cause these jobs to be migrated to the %Windir%\system32\tasks directory when those program versions are executed on modern Windows platforms. In conjunction with the SYSTEM security token used by the Task Scheduler service, this migration behavior can be used along with hard links to grant full permissions of protected files to any user on a Windows system.

We have confirmed that the public exploit code functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019. While Windows 8 still contains this vulnerability, exploitation using the publicly-described technique is limited to files where the current user has write access, in our testing. As such, the impact on Windows 8 systems using the technique used by the public exploit appears to be negligible. We have not been able to demonstrate the vulnerability on Windows 7 systems.

By leveraging the Windows Task Scheduler service, an authenticated attacker can gain full access to protected files. This can allow complete system compromise from a limited Windows user account.

Apply an update

This issue is addressed in the updates for CVE-2019-1069 from Microsoft.