Skip to main content

Windows UWP File Access Vulnerability

A vulnerability in Microsoft's Universal Windows Platform (UWP) allows UWP applications full access to a device's file system without user permission. An attacker could exploit this vulnerability to exfiltrate user and system information or cause a denial-of-service condition of an affected application.
Threat ID:
CC-2755
Category:
Exploit
Threat Severity:
Low
Threat Vector:
Published:
31 October 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A vulnerability in Microsoft's Universal Windows Platform (UWP) allows UWP applications full access to a device's file system without user permission. An attacker could exploit this vulnerability to exfiltrate user and system information or cause a denial-of-service condition of an affected application.

Affected platforms

The following platforms are known to be affected:

Windows 10

  • Microsoft Windows - Version 10
  • Microsoft Windows Server - Version 2019, 2016 and 2012

Threat details

By default, UWP applications are only provided access to the specific files and locations required for their operation, and must ask for explicit permission from the user if they attempt to access other files. Applications with access to the whole file system require the broadFileSystemAccess permission. These permissions are displayed in the Settings screen for each application.

A flaw in the applications Settings screen meant that applications with the broadFileSystemAccess permission did not need to notify the user or display that they required full access on their Windows Store page.

Remediation steps

Type Step

Microsoft addressed this issue in their October 2018 Windows 10 update (Build 1809), by removing the broadFileSystemAccess permission. Users are encouraged to apply this update immediately.

Last edited: 6 September 2021 2:37 pm