Windows GUI Client pipes accept local processes

Summary

The Windows Firezone Client uses named pipes for IPC between the non-elevated GUI and the privileged (Local System) tunnel service, and for single-instance / deep-link handoff. Prior to 1.5.13 these pipes were created without a restrictive DACL. As a result, other processes on the machine — including processes running as the same user, and in some cases other service accounts — could open the tunnel pipe and drive the privileged service, or connect to the GUI pipe and hijack deep-link activation.

Impact

An unprivileged local process could:

• Connect to the tunnel service IPC pipe and control the privileged tunnel — change the Client's configuration (including the control-plane and authentication URLs), start or stop the VPN, and read session state — without any elevation prompt; and
• Connect to the GUI pipe to inject deep links or single-instance messages, including into another logged-in user's signed-in session (e.g. under fast-user-switching or RDP).

The attacker only needs to run code on the machine.

Who is affected

All Windows GUI Client versions prior to 1.5.13. The Windows headless Client is not affected — it does not use these GUI ↔ tunnel named pipes.

Remediation

Upgrade to Windows GUI Client 1.5.13 or later.

1.5.13 pins the tunnel and GUI named-pipe DACLs to the Firezone MSIX package identity using a WIN://SYSAPPID Contains $PFN conditional ACE, so only Firezone's own packaged processes — those carrying the Firezone package family name — can open the pipes. Same-user, non-Firezone processes now receive an "Access Denied" from the Windows kernel. The release also rejects cross-user GUI pipe connections by comparing logon-session IDs, and restricts access to the Client's configuration directory.

Workarounds

There is no configuration-level workaround short of upgrading. Until you can upgrade, reduce exposure by keeping untrusted software off the machine, since any local process can connect to the pipes.

Credits

Found by Oneleet, our SOC 2 compliance vendor, during routine penetration testing of the Firezone product.