<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"><img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/3455ed09b574125bcb96148814c9968e?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FCP-5.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"><a class="user-hover" rel="63728144489de2f7f46161a6" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_63728144489de2f7f46161a6" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=63728144489de2f7f46161a6"> Carl Pearson </a><strong>created</strong> an issue </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"><a href="https://shibboleth.atlassian.net/browse/SSPCPP?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Shibboleth SP - C++</a> / <a href="https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-aff0ec0a-3b67-4362-8d5a-82d0754fc600" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">SSPCPP-961</a></td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/SSPCPP-961?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Shibboleth SP - Windows - possible Privilege Escalation</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><img src="cid:jira-generated-image-avatar-aff0ec0a-3b67-4362-8d5a-82d0754fc600" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Affects Versions:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 3.4.0 </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="557058:5b78efc9-1379-42cc-a3f6-56c6ea3a0007" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_557058:5b78efc9-1379-42cc-a3f6-56c6ea3a0007" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007"> Scott Cantor </a></td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Attachments:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> shibboleth-sp permissions.PNG, shibd.cs </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 14/Nov/22 1:07 PM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Environment:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0; margin-top: 0">Tested with Shibboleth SP v3.4.0 x64 on Windows 10 x64 21H2 build 19044.2251. </p><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">I’ve attached a screenshot of the C:\opt\shibboleth-sp\ folder permissions for “Authenticated Users” group which includes unprivileged accounts on the local system. The screenshot was taken after a new install of Shibboleth SP.</p></td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><img src="cid:jira-generated-image-static-trivial-248e4d80-dee6-4f47-ae39-26c3445ba0ad" height="16" width="16" border="0" align="absmiddle" alt="Trivial" style="vertical-align: text-bottom"> Trivial </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><a class="user-hover" rel="63728144489de2f7f46161a6" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_63728144489de2f7f46161a6" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=63728144489de2f7f46161a6"> Carl Pearson </a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"><h2 style="margin: 10px 0 0; margin-top: 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0; margin-top: 0"><a name="Summary" style="color: #3b73af; text-decoration: none"></a>Summary</h2><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Shibboleth service provider (SP) for Windows creates a new folder path C:\opt\shibboleth-sp\ and installs itself there by default. The Shibboleth SP service ("Shibboleth Daemon") executes the program at C:\opt\shibboleth-sp\sbin64\shibd.exe as NT AUTHORITY\SYSTEM on system startup.</p><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The ACL permissions present on folder C:\opt\shibboleth-sp\ after a new Shibboleth SP install allow an unprivileged, local user account to read, write, modify, and rename contents. The permissions apply to subfolders and files, including folder sbin64/. An unprivileged user account can replace the legitimate Shibboleth shibd.exe binary with a malicious shibd.exe binary which executes with elevated privileges when the Shibboleth service next restarts. An unprivileged user can exploit this vulnerability to execute arbitrary code under privileged SYSTEM context. </p><h2 style="margin: 10px 0 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0"><a name="Reproduction" style="color: #3b73af; text-decoration: none"></a>Reproduction</h2><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Pre-requisites:</p>
<ul>
<li>a Windows host with Shibboleth SP installed in its default location of C:\opt\shibboleth-sp\</li>
<li>.NET framework installed (should be by default on Windows 10)</li>
<li>a normal, unprivileged (i.e. not an administrator) account present on the system.</li>
</ul><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The proof-of-concept payload I used is a .NET executable. I’ll provided the C# source code file for it with this report.</p>
<ol>
<li>Login to the system as the unprivileged user account.</li>
<li>Download the attached shibd.cs C# source code file to the target Windows computer.</li>
<li>Open a Powershell prompt and change to the directory with the downloaded shibd.cs file. For example, if you downloaded the file into C:\ProgramData, then enter:<br> cd C:\ProgramData\</li>
<li>Compile the exploit code using the built-in C# compiler with the following command:<br> C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe shibd.cs<br> If .NET v4.0.30319 isn’t installed, adjust the path to match the installed version. The compiler should create a new file, shibd.exe, in the current folder.</li>
</ol><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">While a Windows service is running, it's executable file is in use and locked. We cannot directly overwrite the existing C:\opt\shibboleth-sp\sbin64\shibd.exe because the Shibboleth Daemon service has the file open and Windows does not allow a process to overwrite a file opened by another process. However, Windows locks the file itself, not the folder and file path name. We can rename the shibd.exe's parent sbin64 folder, create a new folder named sbin64, and plant our shibd.exe binary in the new folder. The resulting file path C:\opt\shibboleth-sp\sbin64\shibd.exe then refers to our file and at next server restart our binary will execute.</p>
<ol>
<li>Rename the folder C:\opt\shibboleth-sp\sbin64\ to C:\opt\shibboleth-sp\sbin64original\</li>
<li>Create a new folder named sbin64 in the shibboleth-sp folder.<br> mkdir C:\opt\shibboleth-sp\sbin64\</li>
<li>Copy the compiled binary to the new folder<br> copy C:\ProgramData\shibd.exe C:\opt\shibboleth-sp\sbin64\shibd.exe</li>
</ol><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The file C:\opt\shibboleth-sp\sbin64\shibd.exe is now the attacker's file instead of the legitmate Shibboleth executable. </p>
<ol>
<li>Restart the computer. This represents a typical computer restart, such as applying monthly OS patches.</li>
<li>When the restart completes, open the local users console (press Windows + R, type lusrmgr.msc, then hit Enter).</li>
<li>Double click the Users folder.</li>
<li>You should see a new user account named localadmin. If you right click the account, click Properties, then click Member Of, you should see the account is a member of the Administrators group on the local computer.</li>
</ol><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">We have demonstrated that, as a unprivileged user account, we can exploit the Shibboleth SP service to gain privileged code execution.</p><h2 style="margin: 10px 0 0; font-size: 20px; font-weight: normal; line-height: 1.500; margin: 40px 0 0"><a name="OtherNotes" style="color: #3b73af; text-decoration: none"></a>Other Notes</h2><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The folder C:\opt do not exist by default and are created during installation. New folders created at the root of C:\ drive appear to be given a default ACL by Windows which allows any user account to create, modify, and delete child files and folders. The Shibboleth installer does not appear to modify this ACL to restrict non admin users from modifying contents.</p><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">The vulnerability does not exist if the Shibboleth installation folder is manually changed during install to be C:\Program Files. The C:\Program Files\ folder has an ACL which blocks unprivileged accounts from modifying subfolders and files.</p></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/SSPCPP-961?inbox=true&",
"name": "View Issue"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"><a href="https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-41482291-301b-44c0-90a3-d359277195f9" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"><a href="https://shibboleth.atlassian.net/browse/SSPCPP-961#add-comment?atlOrigin=eyJpIjoiMDhmNWZjMGM3MmQxNDdlMDhmOWUwYTVjZWE3NjgwMDMiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr><!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100210-<span title="583150f45e96fe66b2cb2898eb1e9ae5719d8732" data-commit-id="583150f45e96fe66b2cb2898eb1e9ae5719d8732}">sha1:583150f</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-4788d059-38ad-49f9-893f-38f86762b7f6" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>