Insecure File Permissions - Privilege Escalation
The Minecraft Launcher on a fresh install of Windows 10 uses insecure file permissions which would allow another user on the system to overwrite the binary "C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe".
Expected/Fix:
The file permissions should be "BUILTIN\Users:(I)(RX)" instead of "BUILTIN\Users:(I)(F)" which would still allow the other users run the launcher, just not overwrite it.
Steps to Reproduce:
Open a command prompt and type
icacls.exe "C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe"
Below is an example of another game launcher's settings vs Minecraft Launcher.

2020-06-13, 06:14 PM
2022-04-06, 06:33 PM
2022-04-06, 06:33 PM
0
1
-