Microsoft has fixed a vulnerability in the Get Help troubleshooting platform on Windows 11 that could allow a standard user to gain SYSTEM-level control of a PC. The issue was identified by security researcher Ben Wilson of Tanto Security and was resolved by Microsoft without the company issuing CVE identifiers for the flaw.
The vulnerability involved Windows’ Diagnostic Execution Service (DiagSvc), which processes troubleshooting packages used by Get Help. These packages contain PowerShell scripts hosted by Microsoft and can run with SYSTEM privileges. SYSTEM is the highest privilege level available to a process on Windows, giving it extensive access to the operating system and the device.
How the Get Help issue could be abused
Wilson found that, unlike older Windows troubleshooting tools, the Windows 11 implementation could allow an ordinary user to launch DiagSvc without an administrator approval prompt. His research focused on the Media Creation Tool troubleshooter, which downloads and runs Microsoft’s utility for creating Windows installation media.
The troubleshooter used a temporary folder that could be written to by standard users. According to the report, two race conditions in the process created opportunities to interfere with the folder and the executable being downloaded. Wilson was able to place his own programme in the relevant location and have it launched with SYSTEM privileges instead of the genuine executable.
| Detail | Information |
|---|---|
| Affected Windows component | Get Help and Diagnostic Execution Service |
| Researcher | Ben Wilson, Tanto Security |
| Exploited troubleshooter | Media Creation Tool troubleshooter |
| Potential impact | Full SYSTEM-level control of the PC |
| CVE identifier | None issued by Microsoft |
Microsoft paid for two reported bugs
Microsoft paid Wilson US$8,000 for the Media Creation Tool issue and another US$8,000 for a separate Outlook diagnostic bug. A third flaw involving the Calendar troubleshooter remains unpaid and is still in disclosure, according to the report.
The incident matters to Windows 11 users in India because the affected troubleshooting framework is built into the operating system rather than being limited to a third-party application. A standard local account could potentially have been used to run code with privileges far beyond those normally available to it. Microsoft has now corrected the reported Get Help issue, although the company did not publish a CVE number for it.
- The flaw affected the Windows 11 Get Help troubleshooting platform.
- It involved DiagSvc, which runs troubleshooting activity with SYSTEM privileges.
- Microsoft fixed the issue and paid US$8,000 each for the Media Creation Tool and Outlook diagnostic bugs.
