CVE-2023-21752 - Windows Backup Service Elevation of Privilege Vulnerability Explained

In January 2023, Microsoft disclosed a critical security vulnerability—CVE-2023-21752—within the Windows Backup Service. This bug allowed attackers to escalate their privileges on affected Windows systems, giving them unnecessary administrative access. If you’re a system admin or any Windows user concerned about security, read on to understand what this vulnerability is, how it works, and what you can do to protect yourself.

What is CVE-2023-21752?

CVE-2023-21752 is a security flaw found in Windows' built-in Backup Service (SDRSVC). Left unpatched, this bug could let a standard user gain SYSTEM-level privileges by exploiting how the service handles access controls.

The vulnerability was considered so severe that it had a CVSS base score of 7.8 (High) and affected multiple supported versions of Windows, including Windows 10 and Windows 11.

How Does the Vulnerability Work?

The root of the problem lies in the way the Backup Service sets permissions on certain files or objects. An attacker logged into the local machine could exploit improper permissions to execute code as SYSTEM—the highest user privilege in Windows.

Target Backup Service's Weak Permissions

- The Backup Service was exposing files or registry keys with permissions that allowed modification by non-privileged users.

Replace or Modify a Service-Used Object

- The attacker could swap out a file or resource used by the service, or create a symbolic link pointing to a malicious payload.

Trigger Elevation

- Once the Backup Service read/used the modified object, it would unwittingly execute code or change configurations under SYSTEM privileges, escalating the attacker’s access.

Sample Code Snippet: Simulating the Exploit

Below is a high-level *pseudo-exploit* to demonstrate the bug's logic. Do not use this code for malicious purposes! Always use it in a lab environment for educational purposes only.

Suppose the Backup Service stored log files in a directory with weak permissions. An attacker could replace a log file with a symbolic link to another sensitive file:

# Malicious PowerShell: Symlink attack against poorly protected backup log
# Assume C:\BackupService\Logs\log.txt is world-writable

# Remove the original log file
Remove-Item C:\BackupService\Logs\log.txt

# Create a symbolic link to a sensitive system file
New-Item -ItemType SymbolicLink -Path C:\BackupService\Logs\log.txt -Target C:\Windows\System32\drivers\etc\hosts

# If the service later writes to 'log.txt' as SYSTEM, it might overwrite hosts file

This example shows how weakly protected log files can be abused, allowing the attacker to overwrite or inject into privileged files.

What Did Microsoft Do About It?

Microsoft patched this bug as part of the January 2023 Patch Tuesday cycle. The fix involved tightening file permissions and access controls within the Backup Service code, so non-admins could no longer alter files, registry entries, or objects related to SDRSVC that could lead to privilege escalation.

References

- Microsoft Security Advisory - CVE-2023-21752
- NIST National Vulnerability Database
- Patch Release Notes

Is There a Public Exploit?

Yes. Proof-of-concept code for this vulnerability has surfaced on open code repositories and security blogs after Microsoft patched it. Security researchers, such as *H4rk3nz* and firms like Akamai, have publicly discussed methods to exploit it.

You can see more technical analyses here

- Akamai Blog: Backup Service Vulnerability Deep Dive
- Security Researcher PoC on GitHub (Archived)

Conclusion

CVE-2023-21752 is a great case study of how “quiet” Windows services can create huge risks when permissions are mishandled. Always keep your system updated, avoid running untrusted code, and watch for more advisories from Microsoft and security researchers.

For updates, check Microsoft’s Security Portal regularly.

Timeline

Published on: 01/10/2023 22:15:00 UTC
Last modified on: 01/18/2023 20:17:00 UTC