BOSH Windows Stemcell Builder SYSTEM Privilege Escalation Vulnerability

Who is affected

How to fix it

BOSH Windows Stemcell Builder before v2019.98 set unsafe permissions on BOSH agent service files, allowing a low-privilege local user to replace service executables and gain SYSTEM execution after restart. Upgrade the builder, rebuild and redeploy Windows stemcells, and inspect affected hosts for tampered BOSH binaries.

1. Inventory deployed Windows stemcells built with bosh-windows-stemcell-builder before v2019.98.
2. Upgrade bosh-windows-stemcell-builder to v2019.98 or later in every stemcell build pipeline.
3. Rebuild affected Windows stemcells and redeploy BOSH-managed Windows VMs from the rebuilt artifacts.
4. Inspect C:\bosh\service_wrapper.exe, C:\bosh\bosh-agent.exe, and related service paths for unexpected ownership, permissions, or file hashes.
5. Reset permissions on BOSH agent service files so unprivileged users cannot replace service executables.
6. Audit local users, RDP access, service restart events, and endpoint telemetry for signs of privilege escalation.
7. Rotate local administrator, BOSH agent, and deployment credentials if binary tampering or unauthorized local access is found.

Verify the fix

• Confirm the builder version is v2019.98 or later and affected VMs use rebuilt stemcells.
• Validate non-administrator users cannot modify BOSH agent executable paths or service wrapper files.
• Compare BOSH agent binary hashes against trusted rebuilt images.
• Review Windows event logs for suspicious service replacement or SYSTEM process launches.
• Run a Fixnx scan and confirm Windows management ports are not publicly exposed.

Related categories

Trusted references

FAQ