CVE-2024-49039: Windows Task Scheduler Elevation of Privilege Vulnerability

Overview

CVE-2024-49039 is a Windows Task Scheduler Elevation of Privilege (EoP) vulnerability that allows an authenticated attacker to escape the AppContainer sandbox, elevating from Low integrity (AppContainer) to Medium integrity. Assigned a CVSS score of 8.8, this vulnerability has been actively exploited in the wild by the RomCom threat group.

• CVE ID: CVE-2024-49039
• CVSS Score: 8.8 (High)
• CWE: CWE-287 (Improper Authentication)
• Discovered by: Google Threat Analysis Group (TAG)
• Exploited by: RomCom group
• Impact: Elevation of Privilege (AppContainer escape)

Technical Details

The vulnerability resides in the Task Scheduler's RPC interface. The scheduler fails to properly authenticate RPC clients, allowing a process running at Low integrity level (e.g., within an AppContainer) to communicate with the Task Scheduler service as if it were a Medium integrity caller. This improper authentication check (CWE-287) enables the attacker to:

1. Register new scheduled tasks
2. Modify existing tasks
3. Trigger task execution with Medium integrity privileges
4. Escape the AppContainer sandbox constraints

By creating or triggering a scheduled task that executes an arbitrary binary, the attacker can break out of browser sandboxes, containerized application environments, or any other AppContainer-based isolation.

Affected Versions

All Windows versions prior to the November 2024 security update are affected, including:

The November 2024 Patch Tuesday (MSRC) addressed this vulnerability. Systems without the November 2024 or later cumulative updates remain vulnerable.

Exploitation

The RomCom group has been observed exploiting this vulnerability in targeted attacks. The attack chain typically involves:

1. Initial access via social engineering or other means
2. Execution of a payload within an AppContainer (e.g., via browser or containerized app)
3. The payload uses the Task Scheduler RPC interface to create/trigger a scheduled task
4. The scheduled task runs at Medium integrity, escaping the sandbox
5. Subsequent privilege escalation or lateral movement

Reproduction Steps

This proof-of-concept is for authorized testing only. Steps:

1. Confirm the target is unpatched (pre-November 2024)
2. Run the exploit script from a Low-integrity context (e.g., an AppContainer)
3. The script interacts with the Task Scheduler to create a task
4. The task executes an arbitrary binary at Medium integrity
5. Verify sandbox escape

PoC

The included exploit.py script demonstrates the vulnerability using Python's comtypes library to interact with the Task Scheduler COM interface.

Usage:

python exploit.py --command "cmd.exe /c whoami > C:\temp\output.txt"

Mitigation

• Apply the November 2024 Microsoft security update (or later)
• Restrict Task Scheduler access via GPO in high-security environments
• Monitor for unexpected scheduled task creation (Event ID 4698)
• Implement AppContainer hardening and additional sandboxing layers
• Deploy EDR detection rules for anomalous scheduled task operations

References

• MSRC Advisory
• NVD Entry
• Google TAG Report
• CWE-287