CVE-2020-1317: 
vulnerability analysis and mitigation

CVE-2020-1317 is an elevation of privilege vulnerability that exists when Group Policy improperly checks access, also known as 'Group Policy Elevation of Privilege Vulnerability'. The vulnerability was discovered and reported to Microsoft, with the initial record creation date being November 4, 2019, and public disclosure in June 2020 (NVD, CVE).

The vulnerability stems from Group Policy's design dichotomy where it needs to deliver per-user policy to unprivileged users through a privileged process. The issue specifically involves Group Policy Preferences (GPP) history files, which are stored in the user's profile under %appdata%LocalMicrosoftGroup Policy. These files are written by the GP engine running as localSystem but are stored in an area where non-privileged users have full rights. The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, Semperis).

The vulnerability allows an attacker to exploit Object Manager symbolic links to redirect arbitrary GPP XML files to locations in c:windowsystem32, where they can be further exploited to open a process running as localSystem. This effectively enables privilege escalation from a regular user to system-level access (Semperis).

The exploit can be triggered by deleting the GPP history file in the user's profile and replacing it with an Object Manager symbolic link. When the GP Engine runs as local system, it writes a new XML file to the specified destination in c:windowssystem32, allowing the attacker to write arbitrary content and exploit it for privilege escalation (Semperis).

Microsoft addressed this vulnerability by moving GPP history files out of the user profile and into the protected %programdata% folder (specifically under %programdata%MicrosoftGroup PolicyUsers). This new location is not writeable by normal users, preventing the use of symbolic links. Additionally, the ntuser.pol file was moved to %programdata%MicrosoftGroupPolicyUsers (Semperis).

According to security researchers, it took Microsoft nearly a year to fix this vulnerability due to the complexity of the fix and the potential impact on various Group Policy areas including Admin Templates, AppLocker, Windows Firewall, Public Key Policy, and others (Semperis).