Privilege Escalation

auth HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

How It Works

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted. The attack exploits the gap between what the system thinks a user can do and what they actually can do through manipulation or exploitation.

Vertical escalation is the classic form—a regular user obtaining administrator rights. This happens through kernel exploits that bypass OS-level security, misconfigurations in role-based access control (RBAC) that fail to enforce boundaries, or direct manipulation of authorization tokens and session data. Horizontal escalation involves accessing resources belonging to users at the same privilege level, typically through insecure direct object references (IDOR) where changing an ID in a request grants access to another user's data.

Context-dependent escalation exploits workflow logic by skipping authorization checkpoints. An attacker might access administrative URLs directly without going through proper authentication flows, manipulate parameters to bypass permission checks, or exploit REST API endpoints that don't validate method permissions—like a read-only GET permission that can be leveraged for write operations through protocol upgrades or alternative endpoints.

Impact

Full system compromise through kernel-level exploits granting root or SYSTEM privileges
Administrative control over applications, allowing configuration changes, user management, and deployment of malicious code
Lateral movement across cloud infrastructure, containers, or network segments using escalated service account permissions
Data exfiltration by accessing databases, file systems, or API endpoints restricted to higher privilege levels
Persistence establishment through creation of backdoor accounts or modification of system configurations

Real-World Examples

Kubernetes clusters have been compromised through kubelet API misconfigurations where read-only GET permissions on worker nodes could be escalated to remote code execution. Attackers upgraded HTTP connections to WebSockets to access the /exec endpoint, gaining shell access to all pods on the node. This affected over 69 Helm charts including widely-deployed monitoring tools like Prometheus, Grafana, and Datadog agents.

Windows Print Spooler vulnerabilities (PrintNightmare class) allowed authenticated users to execute arbitrary code with SYSTEM privileges by exploiting improper privilege checks in the print service. Attackers loaded malicious DLLs through carefully crafted print jobs, escalating from low-privilege user accounts to full domain administrator access.

Cloud metadata services have been exploited where SSRF vulnerabilities combined with over-permissioned IAM roles allowed attackers to retrieve temporary credentials with elevated permissions, pivoting from compromised web applications to broader cloud infrastructure access.

Mitigation

Enforce deny-by-default access control where permissions must be explicitly granted rather than implicitly allowed
Implement consistent authorization checks at every layer—API gateway, application logic, and data access—never relying on client-side or single-point validation
Apply principle of least privilege with time-limited, scope-restricted permissions and just-in-time access for administrative functions
Audit permission inheritance and role assignments regularly to identify overly permissive configurations or privilege creep
Separate execution contexts using containers, sandboxes, or capability-based security to limit blast radius
Deploy runtime monitoring for unusual privilege usage patterns and anomalous access to restricted resources

Recent CVEs (14625)

CVE-2012-4861

EPSS 0% CVSS 4.0

MEDIUM This Month

The web server in InfoSphere Data Replication Dashboard in IBM InfoSphere Replication Server 9.7 and 10.1 through 10.1.0.4 allows remote authenticated users to list directories via a direct request. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Privilege Escalation IBM Infosphere Replication Server

NVD

CVE-2013-2301

EPSS 0% CVSS 4.3

MEDIUM This Month

The OMRON OpenWnn application before 1.3.6 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Privilege Escalation Google Openwnn +1

NVD

CVE-2013-0510

EPSS 0% CVSS 4.3

MEDIUM This Month

IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Privilege Escalation IBM Security Appscan

NVD

CVE-2012-6534

EPSS 10% CVSS 4.3

MEDIUM POC THREAT This Month

Novell Sentinel Log Manager before 1.2.0.3 allows remote attackers to create data retention policies via a crafted text/x-gwt-rpc request to novelllogmanager/datastorageservice.rpc, and allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 10.1%.

Privilege Escalation Sentinel Log Manager Novell

NVD Exploit-DB

CVE-2012-5879

EPSS 12% CVSS 8.2

HIGH POC THREAT Act Now

An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.9%.

Privilege Escalation Mcafee Virtual Technician Epo Mcafee Virtual Technician +1

NVD Exploit-DB

CVE-2013-0925

EPSS 0% CVSS 7.5

HIGH This Week

Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.