[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Rod Widdowson (Jira)]

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMTM0NmEwMGZiOGQwNDRiYzliMTg1MGYyODc1NTA4ZDAiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMTM0NmEwMGZiOGQwNDRiYzliMTg1MGYyODc1NTA4ZDAiLCJwIjoiaiJ9 )

I’m currently (windows) updating my IIS box, but I applied the appropriate ACL and IIS appeared to carry on working which would infer that IIS_APPOOL implies Administrators or LocalSystem (on my machine). Once my box is full updated I'll try with my modified installer.

Of course we then open the complete https://shibboleth.atlassian.net/browse/IDP-1927 ( https://shibboleth.atlassian.net/browse/IDP-1927 ) can or worms because if what I assume above is correct (and also in the Apache case) the web server is running elevated and with write access to a bunch of stuff which is a really, really stupid idea - and in that case we get back to the fact that any sane admin would be locking down these accounts (which of course is why people are always asking in the users list about why their IIS integration doesn’t work - they have locked down their web server and it does not have the correct ACLS set up on /opt

This is such a huge can or worms that I am tempted to actually lock the thing down so much that it will never work and force manual intervention.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMTM0NmEwMGZiOGQwNDRiYzliMTg1MGYyODc1NTA4ZDAiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMTM0NmEwMGZiOGQwNDRiYzliMTg1MGYyODc1NTA4ZDAiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:9b34d7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/8307101b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-2391770b-779d-4265-b75a-685b32c2a0e4
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/8307101b/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-30f1c3b9-f864-4a7a-80c6-bca708feef6e
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/8307101b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-8facd75f-e582-4c7b-b305-7758c6ac02f0
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221117/8307101b/attachment-0005.png>