# Race conditions when applying ACLs

Windows code writes sensitive files then applies restrictive ACLs afterward, letting a local attacker read contents in the race window nearly 100% of the time.

- Payout: Research
- Severity: medium
- Program: Microsoft
- Write-up by: Johann Rehberger
- Disclosed: 2020-08-24
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2020/applying-acls-and-race-conditions/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-applying-acls-and-race-conditions
- Tags: area:os domain:desktop impact:data-leak kind:research platform:research sev:medium tech:windows technique:race-window technique:source-review vuln:info-disclosure vuln:misconfiguration vuln:race-condition

**Target:** Files created with sensitive content before ACL lockdown on Windows
**Root cause:** Code writes sensitive content to a file with inherited/default permissions, then applies restrictive ACLs in a separate later step, leaving a window where the file is readable.
**Steps:**
1. Identify code that calls `File.WriteAllBytes(filePath, content)` followed by `AddFileSecurity(filePath, ...)` and inheritance breaking.
2. Determine the file path (known, predictable, or retrievable).
3. Run a loop calling `File.ReadAllText(path)` in a try/catch, printing contents on success.
4. Catch the file between creation and ACL application to read sensitive content.
**How found:** Noticed the common pattern of writing sensitive content then applying ACLs as two sequential steps, hypothesized a TOCTOU window, and built a C# 'File Stealer' loop to test whether the window was practically winnable.
**Exploitation:** A local adversary repeatedly attempts to read the target file in a tight loop; because file IO is slow relative to the ACL application, the read succeeds before permissions are locked down, exposing the sensitive content.
**Insight:** When reviewing code that writes secrets then locks down permissions, don't dismiss the TOCTOU window as too narrow—a tight read loop against slow file IO wins nearly every time; same pattern applies to user accounts, registry keys, and DB configs.

## Proof of concept (copied exactly from the original report)

**C# loop racing to read file before ACL**

```
while (true)
{
 try
 {
 string content = File.ReadAllText(path);

 Console.WriteLine("*** SUCCESS: File was grabbed before the ACL got applied! ***");
 Console.WriteLine(content);
 break;
 }
 catch (Exception ex)
 {
 //Console.Write("."); //provide feedback of access denied/file not found
 }
}

Console.WriteLine("*** Done");
```