## https://sploitus.com/exploit?id=6E07E6D3-55A9-5CB3-8CC8-675C89415AF8
# CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability
## Overview
CVE-2024-49039 is a Windows Task Scheduler Elevation of Privilege (EoP) vulnerability that allows an authenticated attacker to escape the AppContainer sandbox, elevating from Low integrity (AppContainer) to Medium integrity. Assigned a CVSS score of 8.8, this vulnerability has been actively exploited in the wild by the RomCom threat group.
- **CVE ID**: CVE-2024-49039
- **CVSS Score**: 8.8 (High)
- **CWE**: CWE-287 (Improper Authentication)
- **Discovered by**: Google Threat Analysis Group (TAG)
- **Exploited by**: RomCom group
- **Impact**: Elevation of Privilege (AppContainer escape)
## Technical Details
The vulnerability resides in the Task Scheduler's RPC interface. The scheduler fails to properly authenticate RPC clients, allowing a process running at Low integrity level (e.g., within an AppContainer) to communicate with the Task Scheduler service as if it were a Medium integrity caller. This improper authentication check (CWE-287) enables the attacker to:
1. Register new scheduled tasks
2. Modify existing tasks
3. Trigger task execution with Medium integrity privileges
4. Escape the AppContainer sandbox constraints
By creating or triggering a scheduled task that executes an arbitrary binary, the attacker can break out of browser sandboxes, containerized application environments, or any other AppContainer-based isolation.
## Affected Versions
All Windows versions prior to the November 2024 security update are affected, including:
| Product | Affected |
|---|---|
| Windows 10 (all versions) | Yes |
| Windows 11 (all versions) | Yes |
| Windows Server 2019 | Yes |
| Windows Server 2022 | Yes |
| Windows Server 2025 (if applicable) | Yes |
| Windows Server 2008โ2016 | Yes |
The November 2024 Patch Tuesday (MSRC) addressed this vulnerability. Systems without the November 2024 or later cumulative updates remain vulnerable.
## Exploitation
The RomCom group has been observed exploiting this vulnerability in targeted attacks. The attack chain typically involves:
1. Initial access via social engineering or other means
2. Execution of a payload within an AppContainer (e.g., via browser or containerized app)
3. The payload uses the Task Scheduler RPC interface to create/trigger a scheduled task
4. The scheduled task runs at Medium integrity, escaping the sandbox
5. Subsequent privilege escalation or lateral movement
## Reproduction Steps
This proof-of-concept is for **authorized testing only**. Steps:
1. Confirm the target is unpatched (pre-November 2024)
2. Run the exploit script from a Low-integrity context (e.g., an AppContainer)
3. The script interacts with the Task Scheduler to create a task
4. The task executes an arbitrary binary at Medium integrity
5. Verify sandbox escape
## PoC
The included `exploit.py` script demonstrates the vulnerability using Python's `comtypes` library to interact with the Task Scheduler COM interface.
**Usage:**
```
python exploit.py --command "cmd.exe /c whoami > C:\temp\output.txt"
```
## Mitigation
- Apply the November 2024 Microsoft security update (or later)
- Restrict Task Scheduler access via GPO in high-security environments
- Monitor for unexpected scheduled task creation (Event ID 4698)
- Implement AppContainer hardening and additional sandboxing layers
- Deploy EDR detection rules for anomalous scheduled task operations
## References
- [MSRC Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49039)
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2024-49039)
- [Google TAG Report](https://blog.google/threat-analysis-group/)
- [CWE-287](https://cwe.mitre.org/data/definitions/287.html)