Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.
Sandboxie improperly controls access to other users' sandbox folders in the C:\Sandbox\ location. An authenticated user (UserA) can read files belonging to another user (UserB) located in the C:\Sandbox\UserB\ folder using standard system tools such as explorer.exe or cmd.exe run outside the sandbox. Additionally, if UserB creates a C:\Sandbox\UserA folder with malicious access control lists (ACLs), Sandboxie does not reset these ACLs during sandbox initialization for UserA, which can lead to further unauthorized access or file manipulation. The vulnerability belongs to the path traversal class (CWE-22), enabling access to resources outside the intended isolation scope.
An attacker can read all files edited or created during sandbox processing by other system users, gaining access to potentially sensitive data. By manipulating ACLs in sandbox folders, it is also possible to affect the integrity of other users' sandbox environments.
According to vendor information, the vulnerability has not yet been patched (no patch available). It is recommended to restrict access to systems running Sandboxie to trusted users only. Monitor vendor references (GitHub Security Advisory GHSA-4chj-3c28-gvmp) to track patch availability. As a workaround, manually configure restrictive NTFS permissions on the C:\Sandbox\ folder to prevent cross-user access.
Sandboxie-Plus / Sandboxie for Windows NT systems (32-bit and 64-bit), including Windows 7 and newer. The vulnerability has not been patched to date according to the information contained in the advisory description.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LSandboxie Plus Sandboxie
APPSandboxie-Plus< 1.14.6< 5.69.6
Related vulnerabilities
INI injection w Sandboxie-Plus umożliwia eskalację uprawnień do SYSTEM
Sandboxie-Plus: heap overflow w SbieSvc.exe umożliwia RCE jako SYSTEM
Sandboxie 5.26 — potencjalny Sandbox Escape przez skrypt Python
Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a lo...
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier,...