Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

How it was found

Summary

The Windows installer creates the P2Pool subdirectory inside the machine-wide install path with overly broad write permissions:

• installers/windows/Monero.iss:59
• Name: "{app}\p2pool"; Permissions: users-full

The GUI later trusts and executes p2pool.exe from that directory when the user starts P2Pool mining:

• src/p2pool/P2PoolManager.cpp:124-129 (isInstalled() only checks file existence)
• src/p2pool/P2PoolManager.cpp:154-210 (start() executes p2pool.exe)
• src/p2pool/P2PoolManager.cpp:243-248 (Windows path is {applicationDirPath()}/p2pool/p2pool.exe)
• pages/Mining.qml:295-318 and pages/Mining.qml:654-656 (GUI path to starting P2Pool)

This creates a local binary planting issue: a low-privileged local user can replace or plant p2pool.exe in the writable P2Pool directory, and Monero GUI will later execute that attacker-controlled binary when a victim starts P2Pool from the GUI.

Releases Affected

• Windows installer builds that include commit 432650008c4af92db138041d15b06e43fba0b7ab dated 2022-05-28 (Use "p2pool" folder for p2pool on Windows)
• I have not yet confirmed the earliest tagged release containing this change
• I reviewed the local source tree on 2026-03-20

Why This Is Security-Relevant

The affected directory is part of a machine-wide installed application under Program Files, but the installer intentionally grants broad write access to ordinary users. That turns a trusted executable location into a user-writable code execution surface.

Because the GUI later launches p2pool.exe from that location, any low-privileged local attacker can cause attacker-controlled code to run in the context of whichever user later starts P2Pool from Monero GUI.

This is not a remote issue. It is a local privilege/trust-boundary issue.

Steps To Reproduce

1. Install Monero GUI on Windows using the normal installer.
2. Confirm that the installer created a writable P2Pool directory:
   • Example target path: %ProgramFiles%\Monero GUI Wallet\p2pool
   • Collect ACLs with icacls "%ProgramFiles%\Monero GUI Wallet\p2pool"
3. From a low-privileged local user account, place a benign proof-of-concept executable at:
   • %ProgramFiles%\Monero GUI Wallet\p2pool\p2pool.exe
4. Use a harmless PoC executable that only creates a marker file such as:
   • %TEMP%\monero_p2pool_poc.txt
   • and writes a short message plus current username and timestamp
5. Launch Monero GUI as the victim user.
6. Go to the Mining screen and start P2Pool mining.
7. Observe that the planted p2pool.exe is executed instead of a trusted bundled binary.
8. Verify execution through:
   • the marker file
   • process creation logs
   • GUI behavior

Expected Result

Low-privileged users should not be able to modify executables or executable search locations inside the machine-wide installed application directory.

Actual Result

The installer grants broad write access to the executable P2Pool directory, and the GUI later executes p2pool.exe from that directory without any additional integrity check.

Supporting Material / References

Code references:

• installers/windows/Monero.iss:57-59
• src/p2pool/P2PoolManager.cpp:124-129
• src/p2pool/P2PoolManager.cpp:154-210
• src/p2pool/P2PoolManager.cpp:243-248
• pages/Mining.qml:295-318
• pages/Mining.qml:654-656

Git history:

• Commit 432650008c4af92db138041d15b06e43fba0b7ab dated 2022-05-28
• Commit message: Use "p2pool" folder for p2pool on Windows

Planned attachments:

• TODO: screenshot or text output of icacls on the p2pool directory
• TODO: SHA-256 of the benign planted p2pool.exe
• TODO: screenshot or recording of starting P2Pool from Monero GUI
• TODO: screenshot or contents of the marker file
• TODO: Sysmon / Procmon / Windows Event log process creation evidence showing execution of planted p2pool.exe

Novelty Check

I searched the public Monero GUI repository history, issue tracker, and public advisory surfaces for this behavior. I found the feature-introduction commit above, but I did not find a public security fix, advisory, or public duplicate specifically describing the installer-created writable executable P2Pool directory leading to local binary planting and execution.

AI Assistance Disclosure

I used OpenAI Codex 5.4 with extra high reasoning to help review the local source code and draft this report. All findings, verification status, and final submission contents were reviewed by me before submission.

Impact

A low-privileged local attacker can plant or replace p2pool.exe inside the writable P2Pool directory created by the Windows installer. When another user later starts P2Pool through Monero GUI, the attacker-controlled binary executes in that victim user's context.

This enables:

• cross-user local code execution
• persistence in a trusted application path
• compromise of the victim user's confidentiality, integrity, and availability
• possible privilege escalation if a higher-privileged user later runs Monero GUI and starts P2Pool

In practice, this means local malware or another unprivileged user on the same Windows system can turn Monero GUI's P2Pool feature into an execution trigger for arbitrary code.