# Node Installer Local Privilege Escalation

Node.js Windows installer grants BUILTIN\Users write access to the install dir and adds it to system PATH, letting a local user plant npm.exe or DLLs for privilege escalation.

- Payout: hidden
- Severity: medium
- Program: Node.js
- Found by: deepsurface-robert
- Disclosed: 2021-07-01
- CVE: CVE-2021-22921, CVE-2021-29221, CVE-2021-22117
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1211160
- Library page: https://bugbountylibrary.com/r/h1%3A1211160
- Tags: area:os domain:desktop impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:recon vuln:misconfiguration vuln:path-traversal vuln:privilege-escalation

**Target:** Windows installer / installation directory permissions
**Root cause:** Installer inherits permissive ACLs (BUILTIN\Users Allow *) from the drive root on the chosen install directory and adds that directory to the system PATH, so any local user can write executables/DLLs there.
**Steps:**
1. Install Node 14.17.0 with install dir `C:\tools` and select 'automatically install necessary tools'.
2. Observe ACL `BUILTIN\Users Allow *` on `C:\tools` and that it is appended to system PATH.
3. As unprivileged user: `cp node.exe C:\tools\npm.exe` (or npx).
4. As privileged user run `npm`; Windows resolves `.exe` before `npm.cmd`, executing the planted binary.
5. Alternatively use Process Monitor to identify DLLs node.exe loads from `C:\tools` and plant a malicious DLL.
**How found:** Researcher inspected installation directory ACLs after choosing a custom path and noticed inherited BUILTIN\Users write permission, then checked PATH membership and used Process Monitor to confirm DLL load paths from the unprotected folder.
**Exploitation:** Local unprivileged attacker writes a malicious npm.exe/npx.exe (or DLL) into the world-writable install directory that is on the system PATH; when a privileged user later runs npm or node, the attacker's code executes with elevated privileges.
**Escalation:** Writable PATH dir also allows hijacking of later-in-PATH commands such as chocolatey and any future-installed programs; DLL hijack against node.exe broadens targets.
**Insight:** When auditing Windows installers, choose a non-default install directory and check inherited ACLs from the drive root; a directory that is both user-writable and on system PATH is a direct LPE primitive via .exe-before-.cmd resolution and DLL search order.