# Privileged write to user-writable path

Elevated code writing, loading, or resolving from a location an unprivileged user can control or redirect

_Area: Memory corruption and native code. Seen in 6 disclosed reports; 3 confirmed bounties, median $1,250, range $250-$1,250; latest 2024-08-27. Updated 2026-10-23._

## How it works
A process running with higher privilege (SYSTEM or elevated admin) writes a file, loads a binary/config, or resolves a handler using a location an unprivileged user can control or redirect. The privileged code assumes the resolved location is trusted, but the user controls the directory ACL, a symlink target, an environment variable, a registry key, or the timing between a check and a later use. The privileged operation then lands on an attacker-chosen destination or loads attacker-chosen code. The shared root cause is privileged resolution trusting a user-controlled location; the operation may be a write [E1](https://bugbountylibrary.com/r/h1%3A583184.md)[E4](https://bugbountylibrary.com/r/h1%3A1075449.md), a load [E6](https://bugbountylibrary.com/r/h1%3A852091.md)[E7](https://bugbountylibrary.com/r/h1%3A944735.md), or a lookup [E3](https://bugbountylibrary.com/r/h1%3A530292.md).

## Where it shows up
- SYSTEM service writing a log into a folder with Full Control for unprivileged users [E1](https://bugbountylibrary.com/r/h1%3A583184.md)
- SYSTEM updater writing a log into a user-creatable `%temp%` path [E4](https://bugbountylibrary.com/r/h1%3A1075449.md)
- Elevated installer custom actions expanding `USERPROFILE`/`TEMP` from the invoking user's context [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-07-18-custom-actions-html.md)
- Elevated ShellExecute resolving a URL handler from writable `HKCU\Software\Classes` (a lookup, not a write) [E3](https://bugbountylibrary.com/r/h1%3A530292.md)
- Install directory inheriting `BUILTIN\Users` write and added to system PATH (planting, not a privileged write by the process) [E5](https://bugbountylibrary.com/r/h1%3A1211160.md)
- Integrity check at startup, privileged driver install later from a user-writable path [E6](https://bugbountylibrary.com/r/h1%3A852091.md)
- Service loading a config/DLL from a hardcoded, user-creatable `C:\` build path [E7](https://bugbountylibrary.com/r/h1%3A944735.md)

## How to review
For every privileged write, load, or lookup, ask: can an unprivileged user influence the resolved path or its target? The invariant: a privileged operation must resolve to a location the unprivileged user cannot create, rename, symlink, or substitute. Treat influence vectors separately: directory ACLs [E1](https://bugbountylibrary.com/r/h1%3A583184.md)[E5](https://bugbountylibrary.com/r/h1%3A1211160.md), symlink/redirection of the write target [E1](https://bugbountylibrary.com/r/h1%3A583184.md)[E4](https://bugbountylibrary.com/r/h1%3A1075449.md), environment variables or installer properties feeding the path [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-07-18-custom-actions-html.md), registry handler resolution [E3](https://bugbountylibrary.com/r/h1%3A530292.md), and check-then-use timing [E6](https://bugbountylibrary.com/r/h1%3A852091.md). For symlinks, confirm whether the code follows a pre-planted link and whether the link can be created before the privileged write [E1](https://bugbountylibrary.com/r/h1%3A583184.md)[E4](https://bugbountylibrary.com/r/h1%3A1075449.md). Verify the actual resolved target after resolution, not just the intended path.

## Variants seen
- SYSTEM service log write into a user-Full-Control folder, redirected via symlink [E1](https://bugbountylibrary.com/r/h1%3A583184.md)
- Elevated installer custom action building a path from user-controlled environment variables [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-07-18-custom-actions-html.md)
- Elevated ShellExecute resolving a URL handler from writable HKCU (UAC bypass, lookup) [E3](https://bugbountylibrary.com/r/h1%3A530292.md)
- SYSTEM updater log write into user-controlled temp, symlinked to overwrite a driver [E4](https://bugbountylibrary.com/r/h1%3A1075449.md)
- Installer leaving install dir user-writable and on system PATH [E5](https://bugbountylibrary.com/r/h1%3A1211160.md)
- TOCTOU between startup integrity check and later privileged driver install [E6](https://bugbountylibrary.com/r/h1%3A852091.md)
- Service loading OpenSSL config/DLL from a hardcoded user-creatable path [E7](https://bugbountylibrary.com/r/h1%3A944735.md)

## Impact and severity
Most reached SYSTEM or elevated code execution from a low-privileged user, a full local privilege escalation; severity is high because the primitive looks like a benign log write or handler lookup. The exception is [E3](https://bugbountylibrary.com/r/h1%3A530292.md), a UAC bypass (admin-to-elevated), not low-priv-to-SYSTEM. It worsens when the target is a signed driver or system file [E4](https://bugbountylibrary.com/r/h1%3A1075449.md)[E6](https://bugbountylibrary.com/r/h1%3A852091.md), when the write is silent and needs no interaction beyond triggering the service [E1](https://bugbountylibrary.com/r/h1%3A583184.md)[E4](https://bugbountylibrary.com/r/h1%3A1075449.md), or when the loaded code runs in kernel mode [E6](https://bugbountylibrary.com/r/h1%3A852091.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A583184.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2024-07-18-custom-actions-html.md
- E3: https://bugbountylibrary.com/r/h1%3A530292.md
- E4: https://bugbountylibrary.com/r/h1%3A1075449.md
- E5: https://bugbountylibrary.com/r/h1%3A1211160.md
- E6: https://bugbountylibrary.com/r/h1%3A852091.md
- E7: https://bugbountylibrary.com/r/h1%3A944735.md