Note: This issue is raised across multiple projects, the latest version 🌱lives here.

Problem

Clipboard libraries usually naïvely call CloseClipboard without first impersonating the system's anonymous logon token. According to MS15-097 using CloseClipboard this way potentially allows an Escalation of Privilege (EoP) via the undocumented system call NtUserGetClipboardAccessToken.

This issue only affects users of your library that are incorrectly closing the clipboard from an elevated system process.

NB: Reporting of this vulnerability dates back to 2015 and I wasn't able to find any patches, only the advisory on the security bulletin. I assume this is just some small security issue that is not commonly known.

Related CVEs and information:

• Exploit DB: Microsoft Windows - NtUserGetClipboardAccessToken Token Leak (MS15-023)
  
• MSFT: Security Bulletin MS15-097 / Critical
• NVD: CVE-2015-2527

Related discussion on the issue

Solution

Users who run from an elevated system process should update their dependencies or consult their library authors for a patch.

Library authors should impersonate the system's anonymous logon token using ImpersonateAnonymousToken while calling CloseClipboard instead. This prevents users from "misusing" the API.

Refer to Chromium for a correct/safe implementation:

• Release implementation
• ImpersonateAnonymousToken scope-guard