From 8941f7c9070f1e9e6c7cd465f1072e1700630e36 Mon Sep 17 00:00:00 2001
From: Yuwei Huang <[email protected]>
Date: Mon, 01 Jun 2026 13:25:44 -0700
Subject: [PATCH] Harden Windows Named Mojo Pipe Server for Chromoting Host Services

Harden the Named Mojo Pipe Server on Windows against potential local
privilege escalation.

Mitigations:
*   Set MOJO_SEND_INVITATION_FLAG_UNTRUSTED_PROCESS on client
    invitations to restrict Mojo channel broker access.
*   Enforce session-aware User SID verification of the client process.
*   Add a safe fallback for local user-mode developer environments.
*   Use move semantics for token extraction and explicitly link
    wtsapi32.lib.

Bug: 517798926
Change-Id: I406538b61990fd35084904f433cfc7f37cbbb171
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886655
Auto-Submit: Yuwei Huang <[email protected]>
Reviewed-by: Joe Downing <[email protected]>
Commit-Queue: Yuwei Huang <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1639627}
---
diff --git a/remoting/host/chromoting_host_services_server.cc b/remoting/host/chromoting_host_services_server.cc
index 77c6ce0..8cc4dce 100644
--- a/remoting/host/chromoting_host_services_server.cc
+++ b/remoting/host/chromoting_host_services_server.cc
@@ -23,6 +23,7 @@
 #if BUILDFLAG(IS_WIN)
 #include "base/strings/strcat_win.h"
 #include "base/win/win_util.h"
+#include "mojo/public/c/system/invitation.h"
 #endif
 
 namespace remoting {
@@ -44,6 +45,8 @@
   options.security_descriptor =
       base::StrCat({L"O:", user_sid, L"G:", user_sid, L"D:(A;;GA;;;AU)"});
   options.include_peer_process_info = true;
+  options.extra_send_invitation_flags =
+      MOJO_SEND_INVITATION_FLAG_UNTRUSTED_PROCESS;
 #elif BUILDFLAG(IS_LINUX)
   // Allow the endpoint to be connected by any users iff the server is run as
   // root.
diff --git a/remoting/host/mojo_caller_security_checker.cc b/remoting/host/mojo_caller_security_checker.cc
index b0080bb..20bddec 100644
--- a/remoting/host/mojo_caller_security_checker.cc
+++ b/remoting/host/mojo_caller_security_checker.cc
@@ -26,6 +26,14 @@
 #endif
 
 #if BUILDFLAG(IS_WIN)
+#include <windows.h>
+
+#include <wtsapi32.h>
+
+#include "base/strings/utf_string_conversions.h"
+#include "base/win/access_token.h"
+#include "base/win/scoped_handle.h"
+#include "base/win/sid.h"
 #include "remoting/host/win/trust_util.h"
 #endif
 
@@ -56,6 +64,72 @@
     std::to_array<const std::string_view>({kBundleId, "remote_webauthn"});
 #endif
 
+#if BUILDFLAG(IS_WIN)
+bool IsWinCallerUserSidValid(
+    const named_mojo_ipc_server::ConnectionInfo& caller) {
+  std::optional<base::win::AccessToken> current_token =
+      base::win::AccessToken::FromCurrentProcess();
+  if (!current_token.has_value()) {
+    PLOG(ERROR) << "Failed to open current process token.";
+    return false;
+  }
+
+  std::optional<base::win::Sid> expected_sid;
+
+  // Verify the client's identity depending on the host service context:
+  // - If running as `LocalSystem` (standard service/production mode), the
+  //   host has the necessary TCB privileges (`SE_TCB_NAME`) to query the
+  //   legitimate active session user's token via `WTSQueryUserToken`.
+  // - If running as a standard user process (developer diagnostics/testing
+  //   environments or developer unit tests), the host lacks TCB privileges
+  //   to query other session tokens. In this case, the active remote session's
+  //   owner is simply the current process owner itself, so we securely fall
+  //   back to validating the client against the current host process token.
+  if (current_token->User() ==
+      base::win::Sid::FromKnownSid(base::win::WellKnownSid::kLocalSystem)) {
+    // SYSTEM Mode: Retrieve the target Windows session owner's User SID.
+    HANDLE session_token_raw = nullptr;
+    if (!::WTSQueryUserToken(caller.session_id, &session_token_raw)) {
+      PLOG(ERROR) << "WTSQueryUserToken failed for session ID "
+                  << caller.session_id;
+      return false;
+    }
+    base::win::ScopedHandle session_token_handle(session_token_raw);
+
+    std::optional<base::win::AccessToken> session_token =
+        base::win::AccessToken::FromToken(std::move(session_token_handle));
+    if (!session_token.has_value()) {
+      PLOG(ERROR) << "Failed to get access token from session token handle.";
+      return false;
+    }
+    expected_sid = session_token->User();
+  } else {
+    // User/Developer Mode Fallback: Use current process User SID as the
+    // expected value.
+    expected_sid = current_token->User();
+  }
+
+  std::optional<base::win::AccessToken> client_token =
+      base::win::AccessToken::FromProcess(caller.process.Handle());
+  if (!client_token.has_value()) {
+    PLOG(ERROR) << "Failed to open client process token for PID " << caller.pid;
+    return false;
+  }
+  base::win::Sid client_sid = client_token->User();
+
+  if (client_sid != *expected_sid) {
+    LOG(ERROR) << "Client user SID ("
+               << base::WideToUTF8(client_sid.ToSddlString().value_or(L""))
+               << ") does not match expected user SID ("
+               << base::WideToUTF8(expected_sid->ToSddlString().value_or(L""))
+               << ")";
+    return false;
+  }
+
+  return true;
+}
+#endif  // BUILDFLAG(IS_WIN)
+
 }  // namespace
 
 bool IsTrustedMojoEndpoint(
@@ -114,7 +188,10 @@
     return false;
   }
 #if BUILDFLAG(IS_WIN)
-  return IsBinaryTrusted(caller_process_image_path);
+  if (!IsBinaryTrusted(caller_process_image_path)) {
+    return false;
+  }
+  return IsWinCallerUserSidValid(caller);
 #else
   // Linux binaries are not code-signed, so we just return true.
   return true;
diff --git a/remoting/host/BUILD.gn b/remoting/host/BUILD.gn
index 302f780a..5a78f0fb 100644
--- a/remoting/host/BUILD.gn
+++ b/remoting/host/BUILD.gn
@@ -356,6 +356,7 @@
   }
   if (is_win) {
     deps += [ "//remoting/host/win:trust_util" ]
+    libs = [ "wtsapi32.lib" ]
   }
 }