Windows Task Scheduler, elevation of privilege zero-day

Overview

CVE-2024-49039 is a high-severity elevation of privilege vulnerability in the Windows Task Scheduler RPC interface. This zero-day vulnerability was actively exploited in the wild by an APT cluster tracked by ESET in November 2024 before Microsoft released a patch during the November 2024 Patch Tuesday security updates. The vulnerability allows a low-privileged local attacker to escalate privileges to SYSTEM level, representing a critical security risk for Windows environments.

Technical Details

The vulnerability stems from missing access checks in the Task Scheduler RPC interface. Due to insufficient authorization validation, a non-administrative local user can invoke RPC methods that are normally restricted to higher-privileged accounts. This flaw enables attackers to execute code under accounts they did not authenticate as, including the SYSTEM account.

The attack is local-only, meaning an attacker must first gain some level of access to the target system. However, once local access is obtained, the exploitation is considered trivial. The vulnerability effectively bypasses security controls such as User Account Control (UAC) and AppLocker rules that rely on the assumption that Task Scheduler properly enforces caller privileges.

Impact

The impact of this vulnerability is severe. When combined with any user-context initial access vector-such as phishing, exposed RDP services, or malicious browser plugins-an attacker can achieve SYSTEM-level privileges on affected Windows workstations. This represents complete system compromise, allowing attackers to:

• Execute arbitrary code with highest privileges
• Install persistent backdoors
• Access and exfiltrate sensitive data
• Move laterally across the network
• Disable security controls

ESET confirmed targeted exploitation by an unattributed APT cluster in November 2024, indicating this vulnerability was leveraged in sophisticated targeted attacks.

Mitigation

Organizations should take the following mitigation steps:

1. Apply the November 2024 cumulative update immediately on all Windows systems
2. Audit scheduled tasks for any suspicious additions created during the exposure window before patching
3. Enable Microsoft Defender Attack Surface Reduction (ASR) rule D1E49AAC-8F56-4280-B9BA-993A6D77406C ("Block process creations originating from PSExec and WMI commands") to help detect related lateral movement patterns

Detection

Security teams should monitor for unusual scheduled task creation, particularly tasks created by low-privileged accounts that execute with elevated privileges. Review Task Scheduler logs and audit trails for suspicious activity during the pre-patch exposure period. The Defender ASR rule mentioned above can assist in detecting related attack patterns used for lateral movement.