René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Users can read sensitive information","articleBody":"**Problem**\n\nNormal (low privileged) users can read: \n* Config/fibratus.yml\n* Logs/fibratus.txt\n\n\u003cimg width=\"615\" height=\"455\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/c2901ade-0906-4bdb-a462-009955844fc6\" /\u003e\n\n\u003cimg width=\"689\" height=\"450\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/06a94f34-994c-4525-8633-c6c1bd8aaeaa\" /\u003e\n\nA local attacker is able to gain access to potentially sensitive information (confidentiality). \n\n**Solution**\n\nRemove read permissions for users (non-admins) for the mentioned files.\n\n\n**Additional context**\n\nWhile not necessarily a security vulnerability, it is best practice to not give the attacker access to EDR logs\n. E.g. Defender will only show alert summaries in its UI, but need admin to look at the details. Defender Log files are not readable (`C:\\ProgramData\\Microsoft\\Windows Defender\\Support`).\n\nNote that Defender Windows Events are also user-readable for some reason (`Application and Service Logs/Microsoft/Windows/Windows Defender/operational`). So placing fibratus events in `Windows Logs/Application` is okish. ","author":{"url":"https://github.com/dobin","@type":"Person","name":"dobin"},"datePublished":"2026-01-23T15:38:43.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/568/fibratus/issues/568"}