Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.
The background service skips authorization checks for IPC messages directed to sections with names starting with 'UserSettings_'. At the same time, the service does not filter CRLF characters either in the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or in the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can exploit these gaps to inject a new sandbox section header with unlimited permissions into the Sandboxie.ini file, thereby bypassing EditAdminOnly and ConfigPassword protections. As a result, it is possible to escape the sandboxed environment and gain SYSTEM privileges.
An attacker with a standard local account can take full control of the sandbox configuration, escape the isolated environment, and obtain SYSTEM privileges on the attacked Windows system.
Sandboxie-Plus should be updated to version 1.17.3, in which the vulnerability has been fixed. The patch is available in the project's official repository on GitHub (https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3).
Sandboxie-Plus in versions 1.17.2 and earlier running on Windows systems.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSandboxie Plus Sandboxie
APPSandboxie-Plus< 1.17.3
Related vulnerabilities
Sandboxie-Plus: heap overflow w SbieSvc.exe umożliwia RCE jako SYSTEM
Sandboxie: nieautoryzowany odczyt plików między użytkownikami (path traversal)
Sandboxie 5.26 — potencjalny Sandbox Escape przez skrypt Python
Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a lo...
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier,...