abraxas/vfs-clone-aclVFS for Git ab95cf51 - High - Local - Privilege leftover - clone Authenticated Users GENERIC_WRITE
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · vfs-clone-acl
Class: Privilege leftover Reach: Local
VFS for Git master ab95cf51 (tag v2.0.26259.1) - Microsoft
CloneVerb creates PrimaryEnlistmentRoot with TryCreateDirectoryAccessibleByAuthUsers. That helper adds NT AUTHORITY\Authenticated Users GENERIC_READ|WRITE|EXECUTE|DELETE with ContainerInherit|ObjectInherit. The comment talks about elevated vs non-elevated access for the same user. The SID is every authenticated user.
After the victim gvfs clones, another logged-on user can write into that tree, including src\.git\hooks. The repo stays victim-owned, so git safe.directory does not block.
| ID | no CVE yet |
| Class | Privilege leftover (over-permissive directory ACL / hook plant) |
| Reach | Local |
| CWE | CWE-732, CWE-276 |
| CVSS | High: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Product | VFS for Git |
| Affected | master ab95cf51d6ffd0ee0e2feae7180078fe9ecbbb3a (tag v2.0.26259.1). Windows only. |
| Auth | Local. Victim gvfs clones. Attacker is another authenticated user. |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only. how=gadget (no native Windows / ProjFS). |
This is local host RCE as the cloner on the next git/GVFS hook. Not a SYSTEM shell. The lab planted a canary file only; it did not execute a hook.
Victim has cloned with GVFS. Attacker is another logged-on Authenticated Users principal.
| Privilege | Method / sink | What it grants | Recon / integrity / availability | Lab-proven or inferred |
|---|---|---|---|---|
| Inherit GENERIC_WRITE on the enlistment root | CloneVerb calls TryCreateDirectoryAccessibleByAuthUsers(PrimaryEnlistmentRoot) | Every authenticated user can write the tree | Integrity | Lab-proven on the gadget. icacls line is NT AUTHORITY\Authenticated Users:(OI)(CI)(GR,GW,GE,D), SID S-1-5-11, mask 0xe0010000 |
Inherit that ACE onto children including .git/hooks | ContainerInherit | ObjectInherit | Hooks dir is attacker-writable | Integrity | Lab-proven. authusers_hooks=yes |
Plant a file under src/.git/hooks as the attacker | write VFS-CLONE-ACL-WITNESS | Canary in the victim-owned hooks dir | Integrity | Lab-proven. Owner is attacker uid 1001, text is the witness |
| Run a planted hook as the victim on the next git/GVFS command | overwrite pre-command / GVFS loader in a throwaway clone | Host code as the cloner | Integrity | Inferred. Lab planted a canary file only; it did not execute a hook |
| Write the local object cache the same way | LocalCacheResolver.cs same helper | Cache tree is Auth Users writable | Integrity | Inferred. Lab cloned the enlistment root only |
| Negative: owner-only ACL | 0700, no Authenticated Users ACE | Attacker write denied | Closed | Lab-proven closed. Attacker write is EACCES |
| World-writable other:: | n/a | POSIX other write | Closed | Lab-proven closed. other_write=no |
| Remote unauthenticated write | n/a | Network write | Closed | Local second login |
| SYSTEM shell | n/a | LocalSystem | Closed | Next hook runs as the cloner, not LocalSystem |
Same pin leftovers: vfs-quote-breakout, vfs-mount-dehydrate, vfs-service-sid, vfs-hook-impersonate, vfs-install-cwd.
I pinned VFSForGit master ab95cf51 after the 2026-09-28 merge. Clone creates the enlistment root with a helper whose comment is UAC split-token. The SID is AuthenticatedUserSid. That is every logged-on user, not the creating user.
Wrong turns already recorded: treating this as world-writable other:: (it is not; POSIX other had no write); claiming SYSTEM; executing a planted hook in the lab. Theatre. Native Windows was missing, so the lab is a gadget of those functions as a POSIX named-group ACL.
python3 vfs-clone-acl-Abraxas-Labs.py
or
cd lab
./run.sh
Gadget HTTP on 127.0.0.1:19650. Copies TryCreateDirectoryAccessibleByAuthUsers and applies the same ACE as a POSIX named-group ACL (authusers). Last line uses how=gadget.
SUCCESS vfs-clone-acl how=gadget auth-users-write=yes inherit=OI-CI attacker-hook-write=yes owner-only=eacces VFS-CLONE-ACL-WITNESS
Grant the creating user (and optionally Administrators for UAC), not AuthenticatedUserSid. icacls equivalent is (OI)(CI)(M) for the owner only.
ab95cf51d6ffd0ee0e2feae7180078fe9ecbbb3aCloneVerb.csWindowsFileSystem.cs TryCreateDirectoryAccessibleByAuthUsersLocalCacheResolver.csGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.