# Privileged action trusts stale caller identity

Elevated code deciding access from caller-supplied fields, cached PIDs, or unprotected tokens

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $7,500; latest 2023-05-13. Updated 2026-11-02._

## How it works
Privileged code must decide *who is calling* before acting. This pattern breaks when that decision rests on a value the caller controls or that has gone stale: a client-supplied field, a PID cached earlier, a token nobody protected. The assumption "the caller told us, so it's true" or "we checked once, so it stays true" fails. The privileged side then performs an action on behalf of an identity the attacker chose.

## Where it shows up
- A server or client declares its own privilege level or type, and the privileged side trusts it (e.g. `m_nMaxClients=1` unlocking single-player-only command paths) [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md)
- Caller-validation caches keyed by PID or another reusable identifier, never pruned when the identity dies [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- RPC handlers that skip validating a discriminator field (password type) or pass caller strings into paths [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Telemetry fields (parent PID, machine name, IsLocal) copied from client-supplied `SetClientInfo` and logged as authoritative [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md)

## How to review
Trace every privileged decision back to its source. The invariant: **the identity or privilege level used for the decision must originate from a trusted, current, unforgeable source — not from the caller and not from a stale cache.**
- For each field the caller supplies, ask: can the caller set it, and does the privileged side trust it for a decision? [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md)[E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md)
- For caches: is the key reusable (PID), and is the entry pruned when the identity dies? [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- For RPC handlers: is every discriminator field validated against its expected constant before use? [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- For telemetry: does the "trusted" event copy a client value verbatim, and is that value presented as provenance? [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md)

## How finders spotted it
- Sent a privileged command (`quit`) via a custom server and saw it execute; compared against SourceMod to learn what normally blocks it, then found the server-type check trusting `m_nMaxClients` [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md)
- After a prior CVE, reviewed the RPC caller-validation cache, saw it keyed by FNV-1a hash of PID and never pruned, hypothesized PID reuse collision [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Noted COM/WMI process creation lacked parent telemetry; traced where `ClientProcessId` is populated and found it copied from client `SetClientInfo` [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md)

## Variants seen
- Client-declared privilege level unlocking restricted command paths [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md)
- Stale PID-keyed allowlist cache colliding on reuse [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Missing field validation plus path traversal in a privileged handler [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md)
- Client-supplied provenance fields logged as authoritative [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md)

## Impact and severity
Chained logic bugs reached client RCE from a malicious server [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md); standard user to SYSTEM via three low-severity bugs plus a DLL-hijack gadget [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md); parent-PID and IsLocal spoofing to disguise lateral movement as local [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md). Impact rises when the trusted-identity flaw is combined with a gadget (DLL hijack, insecure fallback) that converts the confused identity into code execution [E1](https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md)[E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Counter-Strike: Global Offensive** (server-type check (m_nMaxClients), fast_dl, con_logfile) (version not stated): CS:GO: From Zero to 0-day. Report: https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aneodyme-io-blog-csgo-from-zero-to-0day.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-zscaler-client-connector-local-privilege-escalation.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-effective-parenting-detecting-lrpc-based-parent-pid-spoofing.md