...[ More ]

----------------------------------------------------------------------------
    NotCVE Advisory — NotCVE-2026-0010
    ----------------------------------------------------------------------------
    
    [-] Summary:
    Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability
    in the IPC command interface exposed by the barrierd.exe service on
    127.0.0.1:24801. The IPC server accepts local TCP clients and processes a
    command line together with a one-byte elevation flag without authenticating the
    connecting process or verifying that it is authorised to request elevated
    process creation. A low-privileged local attacker can therefore execute
    arbitrary commands as NT AUTHORITY\SYSTEM, resulting in complete compromise of
    the affected host. CVSS:3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
    
    [-] Affected:
    Barrier (Debauchee), version 2.4.0 for Windows.
    Earlier affected versions have not been established. Barrier is no longer
    maintained and no patched release has been verified.
    
    [-] Technical Description:
    The Barrier daemon (barrierd.exe) exposes an IPC server on the loopback
    interface at TCP port 24801. A client sends an IHEL client hello identifying
    itself as a supported IPC client type, followed by a kIpcCommand (ICMD) message
    containing a command line and a one-byte elevation flag.
    
    The reviewed IPC acceptance and command-processing paths do not authenticate
    the connecting process, verify its Windows identity, or authorise it to request
    elevated process creation.
    
    When the elevation flag is enabled, DaemonApp::handleIpcMessage() forwards the
    supplied command and elevation value to MSWindowsWatchdog. The watchdog locates
    winlogon.exe in the relevant Windows session, duplicates its privileged token,
    and supplies the attacker-controlled command line to CreateProcessAsUser. The
    command therefore executes as NT AUTHORITY\SYSTEM.
    
    Barrier additionally stores the last IPC-supplied values in the system settings
    as Command and Elevate. These values are loaded again when the daemon starts
    and passed back to the watchdog, so an attacker-supplied elevated command can
    execute again after service restarts or system reboots until the stored command
    is cleared.
    
    Weaknesses: CWE-306 (Missing Authentication for Critical Function), CWE-862
    (Missing Authorization). Pattern: CAPEC-69 (Target Programs with Elevated
    Privileges).
    
    A proof of concept is published in the researcher's repository (see References).
    
    [-] Timeline:
    [25/07/2026] - NotCVE ID requested.
    [27/07/2026] - NotCVE ID reserved.
    [27/07/2026] - Published as NotCVE-2026-0010.
    
    [-] Credit:
    Discovered by Christopher Duram
    (https://www.linkedin.com/in/christopherduram/).
    
    [-] References:
    https://notcve.org/notcve/NotCVE-2026-0010
    https://github.com/cduram/NotCVE-2026-0010
    https://github.com/cduram/NotCVE-2026-0010/blob/main/Debauchee_Barrier_Privesc.py
    https://github.com/debauchee/barrier/releases/tag/v2.4.0
    https://github.com/debauchee/barrier/blob/master/src/lib/ipc/Ipc.h
    https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcServer.cpp
    https://github.com/debauchee/barrier/blob/master/src/lib/ipc/IpcClientProxy.cpp
    https://github.com/debauchee/barrier/blob/master/src/lib/barrier/win32/DaemonApp.cpp
    https://github.com/debauchee/barrier/blob/master/src/lib/platform/MSWindowsWatchdog.cpp
    
    [-] About NotCVE:
    NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
    vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
    Request a NotCVE: https://notcve.org/form/ · Contributors:
    https://notcve.org/hall/
    
    --- packet storm attached poc ---
    
    Attack scenario
    
    1. An attacker obtains low-privileged local code execution on a Windows host where Barrier 2.4.0 is installed and the barrierd.exe service is running.
    
    2. The attacker-controlled process connects to Barrier’s loopback TCP IPC server at 127.0.0.1:24801.
    
    3. The process sends an IHEL hello identifying itself as a supported IPC client type, such as kIpcClientGui.
    
    4. The process sends an ICMD message containing an attacker-controlled command line and an enabled one-byte elevation flag.
    
    5. The IPC server accepts and forwards the command without authenticating the process identity or checking whether the caller is authorised to request elevation.
    
    6. DaemonApp passes the command and elevation value to the Windows watchdog and stores both values in the system configuration.
    
    7. The watchdog locates winlogon.exe, duplicates its privileged token, and invokes CreateProcessAsUser with the supplied command line.
    
    8. The command executes as NT AUTHORITY\SYSTEM; because the stored Command and Elevate values are restored at daemon startup, the command may execute again following service restarts or system reboots.