Mojira Archive
MCL-14335

Insecure File Permissions - Privilege Escalation

The Minecraft Launcher on a fresh install of Windows 10 uses insecure file permissions which would allow another user on the system to overwrite the binary "C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe". 

Expected/Fix:
The file permissions should be "BUILTIN\Users:(I)(RX)" instead of "BUILTIN\Users:(I)(F)" which would still allow the other users run the launcher, just not overwrite it. 

Steps to Reproduce:
Open a command prompt and type

icacls.exe "C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe"

Below is an example of another game launcher's settings vs Minecraft Launcher.

 

Awaiting Response

Carter McKelvain

2020-06-13, 06:14 PM

2022-04-06, 06:33 PM

2022-04-06, 06:33 PM

0

1

Unconfirmed

2.1.15376

-