Privilege Escalation
Privilege escalation is the technique of exploiting a bug, misconfiguration, or design flaw to gain a higher level of access than originally granted, moving from a limited user account to administrative or system-level control.
Definition
Privilege escalation is the technique of exploiting a bug, misconfiguration, or design flaw to gain a higher level of access than originally granted, moving from a limited user account to administrative or system-level control.
Overview
Privilege escalation is typically divided into two categories. Vertical privilege escalation involves gaining a higher permission level on the same system or account, such as a standard user exploiting a flaw to obtain administrator or root access. Horizontal privilege escalation involves gaining access to the resources or data of another user at the same permission level, such as accessing another customer's account in a multi-tenant application without proper authorization checks. Common techniques include exploiting unpatched software vulnerabilities in the operating system or applications, abusing misconfigured file or service permissions (such as a service running as a privileged account with a writable configuration file), exploiting flawed access control logic in applications (like an API that fails to verify a user actually owns the resource it's modifying — an insecure direct object reference), and abusing overly broad permissions granted to service accounts or cloud IAM roles. In cloud environments, privilege escalation frequently exploits chains of seemingly low-risk permissions that, combined, allow an attacker to grant themselves broader access — for example, a permission to modify IAM policies indirectly grants nearly unlimited access. Privilege escalation is a critical stage in most serious attacks: after gaining an initial low-privilege foothold, an attacker generally needs elevated privileges to disable security tools, access sensitive data, create persistent backdoor accounts, or move laterally with administrative reach. Because of this, privilege escalation vulnerabilities are treated as high-severity findings in vulnerability management programs, even when the initial access vector required is low-privilege, since the impact of successful escalation is disproportionately large. Defenses include applying the principle of least privilege so accounts and services only hold the minimum permissions required, promptly patching known privilege escalation vulnerabilities, auditing permission configurations (especially in cloud IAM) for dangerous permission combinations, and monitoring for anomalous privilege changes such as a normal user account suddenly being added to an administrative group.
Key Concepts
- Gains a higher permission level than originally authorized
- Divided into vertical (same system, higher privilege) and horizontal (peer resource access) escalation
- Exploits software vulnerabilities, misconfigurations, or flawed access control logic
- Common in cloud environments via chained, overly broad IAM permissions
- A near-universal stage in serious multi-stage cyberattacks
- Treated as high-severity in vulnerability management due to disproportionate impact
- Mitigated by enforcing least-privilege access and prompt patching
- Detected by monitoring for anomalous privilege or group membership changes