CVE-2020-16940: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-16940) was discovered in the Windows User Profile Service (ProfSvc) related to improper handling of junction points. The vulnerability was reported on July 1, 2020, and publicly disclosed on October 19, 2020. This security flaw affects various versions of Microsoft Windows operating systems (NVD, ZDI Advisory).

The specific vulnerability exists within the handling of the local registry hive by the User Profile service. The flaw allows attackers to abuse the service by creating a junction that can lead to file deletion in incorrect locations. The vulnerability has received multiple CVSS severity ratings: NIST assigned a base score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while Microsoft rated it as 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When successfully exploited, this vulnerability enables attackers to delete files and folders in an elevated context, operating with SYSTEM privileges. The impact is primarily focused on system file integrity and availability, potentially allowing unauthorized deletion of critical system files (ZDI Advisory).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. Once logged in, the attacker can run a specially crafted application that exploits the vulnerability to delete files or folders of their choosing (NVD, ZDI Advisory).

Microsoft has released a security update that addresses the vulnerability by correcting how the Windows User Profile Service handles junction points. Users are advised to apply the security patch to affected systems (Microsoft Advisory).