[JIRA] (SSPCPP-961) Shibboleth SP - Windows - possible Privilege Escalation

[Carl Pearson (Jira)]

Carl Pearson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=63728144489de2f7f46161a6 ) *commented* on SSPCPP-961 ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiZjJjN2U5NWU0YmY4NDNhMmE3ZWVlMDQwM2ZmMjA5M2UiLCJwIjoiaiJ9 )

Re: Shibboleth SP - Windows - possible Privilege Escalation ( https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiZjJjN2U5NWU0YmY4NDNhMmE3ZWVlMDQwM2ZmMjA5M2UiLCJwIjoiaiJ9 )

I have requested a CVE from MITRE to track this from the security perspective. I understand the difficulty in maintaining proper privilege separation on servers. That said, the ability to move from an unprivileged account context to a privileged context without an administrator’s knowledge or authorization is something I would consider a security risk. Windows enforces the unprivileged/privileged security boundary on server OSes, and system administrators might not otherwise have detected the potential to cross the boundary through the SP install folder permissions. The updated Shibboleth documentation does help inform users/admins of the risk so they can take action or not as desired, and a CVE should help with that as well. Regardless, thank you for working on the issue and for working through the reporting process.

( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiZjJjN2U5NWU0YmY4NDNhMmE3ZWVlMDQwM2ZmMjA5M2UiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiZjJjN2U5NWU0YmY4NDNhMmE3ZWVlMDQwM2ZmMjA5M2UiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100213- sha1:cca7326 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230110/9c827f13/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-53e8cea9-ce9a-42bd-b414-85173b950542
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230110/9c827f13/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-df51f412-86cb-4706-96bd-196e73f294d5
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230110/9c827f13/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-babbfbd2-a3ae-4354-9423-b5c616ef6087
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230110/9c827f13/attachment-0005.png>