Privilege Escalation

In every computer system, not every user has the same capabilities. A regular account may open its own files and launch programs. An administrative account, by contrast, may do almost anything: install software, delete other accounts, disable protective functions. Privilege escalation means that someone works their way up from the first level to the second without authorization. The attacker thus gains powers that were never assigned to them. The German term for this is 'Rechteausweitung'.

From a Small Breach to Full Control

Almost no attack begins with full access right away. Usually, an attacker first gains access to an insignificant account, for example through a stolen password or a manipulated website. From there, the damage is initially limited. It is only privilege escalation that turns this small breach into a serious incident.

With administrative rights, an attacker can read all data on a server, including that of other users. They can delete log files and thereby cover their tracks. And they can embed themselves permanently, so that a password change no longer locks them out. This is precisely why privilege escalation is considered a particularly critical type of vulnerability in security research.

For companies, this is also a matter of money and liability. A data breach can result in fines under European data protection regulations. That’s why major providers often pay especially high rewards for reported vulnerabilities of this kind, sometimes reaching six-figure sums.

Typical Paths to the Top

A common route is programming errors in software that runs with high privileges. Operating systems have components that inherently require extensive access, for example to manage memory or devices. If an attacker sends such components unexpected input, they can trick them into performing actions that were never intended. The attacker then executes their own code with the privileges of that component.

A second route is simply misconfigured permissions. If a configuration file is accidentally writable by everyone, any user can insert commands into it. If the system later launches this file with administrative rights, the foreign commands get executed along with it. A comparison: the vault room is well secured, but the key lies in the open drawer right next to it.

Experts distinguish between two directions. Vertical privilege escalation leads upward, from user to administrator. Horizontal privilege escalation stays at the same level but accesses other people’s accounts — for example, when changing the order number in the address bar of an online shop reveals another customer’s order. Both belong to the same family of vulnerabilities.

Security Updates, Cloud, and AI Agents

Anyone who reads the monthly security updates for Windows, Android, or iOS will regularly encounter the note “Elevation of Privilege”. This is the same phenomenon under a different name. Such vulnerabilities are often classified as urgent because, in combination with other flaws, they can lead to the complete takeover of a device.

In the cloud — that is, rented computing power in third-party data centers — this topic is especially sensitive. There, many customers share the same hardware. If an attacker manages to break out of their isolated environment, they could theoretically reach neighboring systems. Providers therefore invest considerable effort in maintaining this separation.

The term is now also being discussed in the context of AI assistants that carry out tasks autonomously and are granted access to files, emails, or programs for this purpose. Hidden instructions embedded in a document can prompt such a system to use its access rights for foreign purposes. The countermeasure is the same basic rule in all cases: every account and every program should receive only the minimally necessary rights.