abraxas/vfs-install-cwdVFS for Git ab95cf51 - High - Local - LPE - installer CWD unqualified gvfs.exe
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · vfs-install-cwd
Class: LPE Reach: Local
VFS for Git master ab95cf51 (tag v2.0.26259.1) - Microsoft
Setup.iss PrepareToInstall always calls ExecWithResult('gvfs.exe', 'service --list-mounted', '', ...) through {cmd} /S /C with an empty WorkingDir. That inherits the directory from which the admin launched SetupGVFS*.exe. cmd.exe searches CWD then PATH. UnmountRepos uses the same unqualified name.
The same file already qualifies the safe paths. sc.exe is {sys}\SC.EXE. Post-install remount is {app}\gvfs.exe. First install has no real gvfs.exe on PATH yet, so a plant next to the signed installer wins.
| ID | no CVE yet |
| Class | LPE (elevated installer CWD search / unqualified exec) |
| Reach | Local (UI:R) |
| CWE | CWE-427, CWE-428 |
| CVSS | High: 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| Product | VFS for Git |
| Affected | master ab95cf51d6ffd0ee0e2feae7180078fe9ecbbb3a (tag v2.0.26259.1). Windows only. |
| Auth | Local. Plant gvfs.exe in the directory from which an admin launches SetupGVFS*.exe. |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only. how=gadget (no native SetupGVFS*.exe). |
Sibling of CVE-2021-47874 (unquoted binPath), different sink. sc.exe and the remount path on this pin are already qualified.
Plant a benign gvfs.exe next to the signed installer. When an admin launches setup from that folder, PrepareToInstall runs the plant as the elevated installer.
| Privilege | Method / sink | What it grants | Recon / integrity / availability | Lab-proven or inferred |
|---|---|---|---|---|
| Inherit installer CWD | ExecWithResult empty WorkingDir (Setup.iss ~830) | Search starts in the launch folder | Integrity of search order | Lab-proven. Gadget working_dir="", search cwd-then-path. |
Resolve unqualified gvfs.exe from CWD before PATH | cmd.exe /S /C ""gvfs.exe" service --list-mounted > ..." | Plant wins over PATH | Integrity | Lab-proven. prepare-resolved=cwd-plant, resolved /lab/cwd/gvfs.exe. PATH copy was not hit. |
| Run as the elevated installer | Witness file owner = gadget uid (stand-in for elevated setup) | Admin-equivalent code execution | Integrity | Lab-proven on the gadget uid. Native admin IL not available on this host. |
| Same plant on unmount | Exec('gvfs.exe', 'service --unmount-all', '', ...) (Setup.iss ~544) | Plant runs again during unmount | Integrity | Lab-proven. unmount-resolved=cwd-plant. |
| Continue setup after the plant | Plant exits 0 and writes a canary only | Setup proceeds | Availability of install | Lab-proven. Witness text is VFS-INSTALL-CWD-WITNESS. No payload. |
Closed on this leftover: remount {app}\gvfs.exe (remount-resolved=app, remount-plant=no). Quoted {sys}\SC.EXE (sc-resolved=sys). POSIX PATH-only search (unix-cwd-search=no). Live SetupGVFS*.exe / ProjFS (this host is macOS; how=gadget). Remote unauthenticated exec. Unquoted ImagePath CVE-2021-47874 (already quoted binPath).
Same pin leftovers: vfs-quote-breakout, vfs-mount-dehydrate, vfs-clone-acl, vfs-service-sid, vfs-hook-impersonate.
I pinned VFSForGit master ab95cf51 after the 2026-09-28 merge. The skip list is CVE-2021-47874. Setup.iss already quotes binPath and qualifies {sys}\SC.EXE and {app}\gvfs.exe. PrepareToInstall still passes a bare gvfs.exe to cmd.exe.
Wrong turns already recorded: re-filing CVE-2021-47874; treating POSIX PATH-only search as the Windows bug; claiming remount is also unqualified. Theatre. Native Windows was missing, so the lab is a gadget of ExecWithResult plus cmd CWD-then-PATH search.
python3 vfs-install-cwd-Abraxas-Labs.py
or
cd lab
./run.sh
Gadget HTTP on 127.0.0.1:19680. Witness VFS-INSTALL-CWD-WITNESS. Last line uses how=gadget.
SUCCESS vfs-install-cwd how=gadget prepare-resolved=cwd-plant prepare-witness=yes remount-resolved=app remount-plant=no unix-cwd-search=no VFS-INSTALL-CWD-WITNESS
ExpandConstant('{app}\gvfs.exe') when present, else skip the list-mounted query on first install. Never pass a bare gvfs.exe to cmd.exe. Qualify UnmountRepos the same way.
ab95cf51d6ffd0ee0e2feae7180078fe9ecbbb3aSetup.iss PrepareToInstall / UnmountRepos / {sys}\SC.EXE / {app}\gvfs.exeImagePathGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.