# Windows builds with insecure path defaults (CVE-2019-1552)

OpenSSL mingw builds defaulted OPENSSLDIR to C:/usr/local, world-writable on Windows, letting low-priv users plant openssl.cnf and load a malicious engine for code execution.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: mirchr
- Disclosed: 2019-09-24
- CVE: CVE-2019-1552, CVE-2019-5443, CVE-2019-12572, CVE-2019-10211
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/683318
- Library page: https://bugbountylibrary.com/r/h1%3A683318
- Tags: domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:low tech:windows technique:chained technique:default-creds vuln:misconfiguration vuln:privilege-escalation

**Target:** OpenSSL mingw/Windows builds (OPENSSLDIR default config path)
**Root cause:** mingw build targets assumed a Unix-like install and defaulted prefix/OPENSSLDIR to /usr/local, which on Windows resolves to C:/usr/local — a directory low-privileged users can create and write to.
**Steps:**
1. Identify a Windows app/service linking OpenSSL built with mingw defaults (OPENSSLDIR=C:/usr/local/ssl).
2. As a low-priv user, create `C:\usr\local\ssl\openssl.cnf` (path is world-writable/creatable under C:\).
3. In openssl.cnf set `openssl_conf = openssl_init` and `[openssl_init] engines = engine_section`, pointing `dynamic_path` to an attacker-supplied DLL.
4. Wait for the privileged process/service to initialize OpenSSL, which loads the config and the malicious engine DLL.
5. DLL executes with the calling process's authority (e.g. SYSTEM).
**How found:** Reporter noticed mingw targets defaulted OPENSSLDIR to /usr/local, realized Windows resolves this to C:/usr/local which low-priv users can create, then confirmed the config/engine load path in over a dozen Windows applications.
**Exploitation:** Local low-privileged attacker plants a crafted openssl.cnf plus malicious engine DLL in the world-writable C:/usr/local tree; when a privileged service using the affected OpenSSL build initializes, it loads the config and engine, executing attacker code as SYSTEM.
**Escalation:** Chained across many Windows apps (curl, PIA, stunnel, EnterpriseDB installer) turning a low-rated OpenSSL default into local privilege escalation to SYSTEM.
**Insight:** On Windows, Unix-style default paths like /usr/local map to C:/usr/local, which is user-creatable — audit any cross-compiled library's default config/plugin search paths for writable locations reachable by privileged processes.