Microsoft Windows TS WebProxy Directory Traversal Vulnerability (CVE-2015-0016)

What is affected, what to do

Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server 2008 eq r2..r2
• Microsoft Windows Server 2012 eq r2..r2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory legacy hosts: Identify every Windows 7 SP1, Windows 8/8.1, Windows RT/RT 8.1, Windows Server 2008 R2 SP1 and Windows Server 2012/2012 R2 machine via CMDB, EDR inventory or the AD operatingSystem attribute. Windows 10/11 and Server 2016+ are not affected. Pay particular attention to OT engineering workstations, HMI clients, jump hosts and kiosks.
   • Apply the security update: Microsoft fixed this vulnerability in Security Bulletin MS15-004 (January 2015). Look up the per-OS KB numbers in the vendor advisory. Verify the fix with Get-HotFix or your WSUS/SCCM compliance report. A host still missing a 2015 patch indicates a broader patch-management failure on that system.
   • Escalate unpatchable or EOL systems: All affected versions are out of support. Treat any host without ESU coverage and without the January 2015 update as critical, and stop web browsing on it immediately.
   • Restrict browsing on affected hosts: This bug is typically chained as an Internet Explorer Protected Mode sandbox escape (Low → Medium Integrity). Disable IE via GPO, or block web access for this asset class at the proxy.
   • Hunt for compromise: On unpatched hosts, retro-hunt in EDR for any process spawned by tswbprxy.exe (see Detection rules). On a hit, isolate the host and reset the logged-on user's credentials.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration (endpoint): Under HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\, locate the subkey whose AppName is TSWbPrxy.exe. Change its Policy value so it no longer silently elevates to Medium Integrity, or remove the subkey. Test beforehand if you rely on RD Web Access through IE.
   • Application control: Use AppLocker or WDAC to block %SystemRoot%\System32\tswbprxy.exe for standard users where ActiveX-based RD Web Access is not required. Also block execution from user-writable paths (%TEMP%, %APPDATA%, %LOCALAPPDATA%\Low).
   • Network segmentation: Move EOL Windows hosts into a dedicated VLAN and permit outbound HTTP/HTTPS only through an allowlisting proxy, with no direct internet egress.
   • Web gateway filtering: Block exploit-kit-style content (Flash, Java, unknown ActiveX) for these segments at the secure web gateway. The first stage of the chain is usually a browser RCE.
   • Least privilege: Ensure users on these hosts have no local admin rights. That way, reaching Medium Integrity is not a short hop to full system control.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Security 4688 – process ancestry: Any child process of tswbprxy.exe is highly suspicious. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "tswbprxy.exe". Sigma shape: ParentImage|endswith: '\tswbprxy.exe' with level high.
   • Integrity-level jump: Watch for the chain iexplore.exe (Low IL) → tswbprxy.exe → cmd.exe/powershell.exe/rundll32.exe or an unknown binary at Medium IL. Use the MandatoryLabel field in 4688 (S-1-16-4096 = Low, S-1-16-8192 = Medium).
   • Path manipulation: Look for traversal sequences in the tswbprxy.exe command line or in its children. SPL: index=sysmon EventCode=1 ParentImage="*\\tswbprxy.exe" OR (Image="*\\tswbprxy.exe" CommandLine="*..\\*").
   • Sysmon EID 11 / 13: Alert on file creation by tswbprxy.exe outside System32, and on registry writes under ...\Low Rights\ElevationPolicy\* by non-installer processes.
   • Proxy telemetry: Correlate IE requests to newly registered or uncategorised domains with a new process making outbound connections shortly afterwards (Zeek conn.log + EDR).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Windows 7
• Microsoft Microsoft Windows 8 Professional Edition
• Microsoft Microsoft Windows 8.1
• Microsoft Microsoft Windows RT Gold
• Microsoft Microsoft Windows RT 8.1
• Microsoft Microsoft Windows Server 2008
• Microsoft Microsoft Windows Server 2012
• Microsoft Microsoft Windows Vista Gold on X64

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

References & sources

• securityfocus.com71965Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• securitytracker.com1031524Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• exchange.xforce.ibmcloud.comms-windows-cve20150016-priv-esc(99515)Vulnerability database, x_refsource_XF, Third-party advisory, Vulnerability database
• blog.trendmicro.comtrendlabs-security-intelligence/cve-2015-0016-escaping-the-inte…x_refsource_MISC, Exploit
• exchange.xforce.ibmcloud.comwin-ms15kb3025421-update(99516)Vulnerability database, x_refsource_XF, Third-party advisory, Vulnerability database
• exploit-db.com35983Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• secunia.com62076Third-party advisory, x_refsource_SECUNIA, Broken link
• packetstormsecurity.comfiles/130201/MS15-004-Microsoft-Remote-Desktop-Services-Web-Pro…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• docs.microsoft.comMS15-004Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0016government-resource, US government resource