[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiNzYwZmY0NDA2YmNiNDZiMTgyZGMzODUzNjllMmVmNTQiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiNzYwZmY0NDA2YmNiNDZiMTgyZGMzODUzNjllMmVmNTQiLCJwIjoiaiJ9 )

I would be interested in the (precise) OS you reproduced this under. I cannot reproduce this on Server2016

C:\opt\shibboleth-sp>ver

Microsoft Windows [Version 10.0.14393]    

Either from powershell

PS C:\opt\shibboleth-sp> mv .\sbin64\ .\sbin64sss
mv : Access to the path 'C:\opt\shibboleth-sp\sbin64\' is denied.
At line:1 char:1
+ mv .\sbin64\ .\sbin64sss
+ ~~~~~~~~~~~~~~~~~~~~~~~~
   + CategoryInfo          : WriteError: (C:\opt\shibboleth-sp\sbin64\:DirectoryInfo) [Move-Item], IOException
   + FullyQualifiedErrorId : MoveDirectoryItemIOError,Microsoft.PowerShell.Commands.MoveItemCommand

or cmd

C:\opt\shibboleth-sp>rename sbin64 sbin64original
Access is denied.

However on Win10 21H2 I can

C:\Users\rdw>cd \opt\shibboleth-sp

C:\opt\shibboleth-sp>rename sbin64 ddd

C:\opt\shibboleth-sp>ver

Microsoft Windows [Version 10.0.19044.2130]

C:\opt\shibboleth-sp>

Note on both Operating Systems you cannot rename any of the libs installed under Program Files (even with the service stopped) (

C:\Program Files\Shibboleth\SP>rename lib lob
Access is denied.

Incidentally this is why the IdP is safe from such an attack - it installs to PF86 by default.

So out of an abundance of caution we should be locking down \opt (an relying on inheritance for the rest) I would defer to Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) but it seems that a GENERIC_ALL permission for Admininstrators and LocalSystem should do. My memory is that this will replace the exiting ACL and remove ACL inheritance from {{}} (This being what is getting in the way here), but that will of course need to be tested. This comes with the pain to the sysadmin that they will need to be elevated to get into these directories (which is a behavior which IdP Admins will be used to when they go into the conf or credentials folder).

The missing piece is that we claim that we change the ACLs ( https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restrictive-ACL-on-the-configuration-file ). I have been looking after the windows installers for a while and this rings no bells with me (nor can I find any appropriate code). I want to understand this before I proceed.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiNzYwZmY0NDA2YmNiNDZiMTgyZGMzODUzNjllMmVmNTQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiNzYwZmY0NDA2YmNiNDZiMTgyZGMzODUzNjllMmVmNTQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:28a3636 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/afbf34b9/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-88b56f94-2546-4005-97ab-e1ffaf36137c
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/afbf34b9/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-e3888182-a9fc-44a8-b51b-d51003946b17
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/afbf34b9/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-988fe34f-6389-428c-978c-3e69ac01313d
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221115/afbf34b9/attachment-0005.png>