CVE-2019-1388 — Windows UAC Certificate Dialog Bypass

CVE-2019-1388 is an elevation-of-privilege vulnerability in the Windows Certificate Dialog that allows a standard user to execute code as NT AUTHORITY\SYSTEM without triggering a UAC prompt. The dialog fails to properly enforce user privileges when displaying certificate issuer information, enabling a UI-redirection attack that spawns an elevated browser instance. ¹

Affected systems

Per the Microsoft advisory and community testing:

OS	Build	Status
Windows 7 SP1	7601	Vulnerable
Windows 8 / 8.1	9200 / 9600	Vulnerable
Windows 10 1511	10240	Vulnerable
Windows 10 1607	14393	Vulnerable
Windows 10 1703+	15063+	Not vulnerable (patched)
Windows Server 2008 R2	7601	Vulnerable
Windows Server 2012 R2	9600	Vulnerable
Windows Server 2016	14393	Vulnerable
Windows Server 2019	17763	Not vulnerable

Exploitation with hhupd.exe

The canonical exploit uses hhupd.exe — a legitimate but outdated HTML Help update utility signed by Microsoft. Because it carries a valid signature and requests elevation, the UAC prompt appears; the attacker then abuses the certificate dialog to break out of the secure desktop:

1. Run hhupd.exe (requests admin via UAC).
2. On the UAC prompt, click “Show more details” (or the certificate information link).
3. Click the issuer link — this opens Internet Explorer with elevated privileges in the background.
4. Close the UAC dialog.
5. In the elevated IE window, use File > Save As (or Ctrl+O / Ctrl+S).
6. Navigate to C:\Windows\System32\ and open cmd.exe — an elevated command prompt spawns.

From there, any file can be read or written as SYSTEM. The technique is entirely GUI-driven and leaves no traditional exploit artifacts beyond the UAC event log. ²

Detection

• Sysmon EID 1 — hhupd.exe spawning iexplore.exe or cmd.exe as children is anomalous; legitimate hhupd execution is vanishingly rare.
• Windows Security Event 4688 — process creation with hhupd.exe as parent and cmd.exe/powershell.exe as child.
• UAC event logs — the certificate dialog interaction generates a UAC consent event (Event ID 4673/4674) but not a successful elevation consent for the spawned process — a mismatch worth alerting on.

Mitigation

• Apply the November 2019 Patch Tuesday update (or later) — the certificate dialog now properly enforces user privileges.
• Remove or restrict execution of legacy signed binaries (hhupd.exe, msra.exe, sdclt.exe) that auto-elevate.

Relationship to other UAC bypasses

Unlike fodhelper-uac-bypass (registry HKCU hijack) or bypassuac_eventvwr (Metasploit module), CVE-2019-1388 is a pure UI vulnerability — no registry writes, no file drops, no DLL hijacking. It belongs to the class of “auto-elevate signed binary + insecure dialog” flaws that also includes computerdefaults.exe and eventvwr.exe issues patched in the same era.

Sources

• NVD — CVE-2019-1388: Windows Certificate Dialog Elevation of Privilege Vulnerability
• GitHub — jas502n/CVE-2019-1388: UAC Privilege Escalation (NT AUTHORITY\SYSTEM)
• CVE-2019-1388 — hhupd.exe Analysis — Nagenrauft Consulting (via Wayback Machine)
• Microsoft Security Update Guide — CVE-2019-1388: Windows Certificate Dialog Elevation of Privilege Vulnerability

Related: fodhelper-uac-bypass, windows-privesc-recon-scripts, windows-remote-management, evil-winrm

Footnotes

1. NVD — CVE-2019-1388: Windows Certificate Dialog Elevation of Privilege Vulnerability ↩

2. GitHub — jas502n/CVE-2019-1388: UAC Privilege Escalation (NT AUTHORITY\SYSTEM) ↩