CVE-2019-1385

CVE-2019-1385 is an elevation-of-privilege flaw in the Windows AppX Deployment Extensions, which improperly manage privileges (CWE-59, a link-fault weakness) and allow access to system files normally reserved for higher-privileged users. An authenticated attacker with a low-privilege account must run a specially crafted application on a vulnerable machine; no user interaction is required. Successful exploitation yields elevated privileges on the local system, typically SYSTEM-level access, which can enable full compromise of the host and serve as a step in broader attack chains. Affected systems are Windows 10 versions 1709, 1803, 1809, and 1903, plus Windows Server 2016 and Windows Server 2019. The flaw was fixed in Microsoft's November 2019 Patch Tuesday, and despite no known public proof-of-concept it has been added to the CISA KEV catalog (May 2022) with known ransomware use, so active exploitation is established.

What to do: Apply the November 2019 Microsoft cumulative security updates (or any later cumulative update) on all affected Windows 10 and Windows Server hosts, prioritizing internet-facing and domain servers running Server 2016/2019 given the known ransomware use and KEV listing. Systems on end-of-service builds such as 1709, 1803, and 1903 should be upgraded to a supported Windows 10 release where extended updates are not in place. After patching, verify the installed OS build in your asset inventory, and restrict interactive logon rights for unprivileged users on servers as defense-in-depth.