Microsoft mystery folder fix might need a fix of its own
- Reference: 1745517666
- News link: https://www.theregister.co.uk/2025/04/24/microsoft_mystery_folder_fix/
- Source link:
The folder, typically c:\inetpub , reappeared on Windows systems [1]in April as part of Microsoft's mitigation for CVE-2025-21204, an exploitable elevation-of-privileges flaw within Windows Process Activation. Rather than patching code directly, Redmond simply pre-created the folder to block a symlink attack path. For many administrators, the reappearance of this old IIS haunt raised eyebrows, especially since the mitigation did little beyond ensuring the folder existed.
For at least one security researcher, in this case Kevin Beaumont, the fix also presented an opportunity to hunt for more vulnerabilities. After poking around, he [2]discovered that the workaround introduced a new flaw of its own, triggered using the [3]mklink command with the /j parameter.
[4]
It's a simple enough function. According to Microsoft's documentation, mklink "creates a directory or file symbolic or hard link." And with the /j flag, it creates a directory junction - a type of filesystem redirect.
[5]
[6]
Beaumont demonstrated this by running: " mklink /j c:\inetpub c:\windows\system32\notepad.exe ." This turned the c:\inetpub folder - precreated in Microsoft's April 2025 update to block symlink abuse - into a redirect to a system executable. When Windows Update tried to interact with the folder, it hit the wrong target, errored out, and rolled everything back.
"So you just go without security updates," he noted.
[7]
The kicker? No admin rights are required. On many default-configured systems, even standard users can run the same command, effectively blocking Windows updates without ever escalating privileges.
[8]When Microsoft made the Windows as a Service pivot
[9]Don't delete that mystery empty folder. Windows put it there as a security fix
[10]Microsoft 365 Copilot gets a new crew, including Researcher and Analyst bots
[11]CVE fallout: The splintering of the standard vulnerability tracking system has begun
It sounds trivial, but now sysadmins will have to scan for tampered junctions until Redmond sorts it out. Once again, Microsoft's testing process is under the microscope, and admins are left wondering how such a basic DoS route slipped into production. Symlinks and junctions have long been an [12]attack vector .
According to Beaumont, Microsoft has been notified. The Windows giant has yet to respond. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2025/04/14/windows_update_inetpub/
[2] https://doublepulsar.com/microsofts-patch-for-cve-2025-21204-symlink-vulnerability-introduces-another-symlink-vulnerability-9ea085537741
[3] https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mklink
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aAq0jp7sa6JUvdGChK281QAAAFM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aAq0jp7sa6JUvdGChK281QAAAFM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aAq0jp7sa6JUvdGChK281QAAAFM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aAq0jp7sa6JUvdGChK281QAAAFM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/04/23/when_microsoft_made_the_windows/
[9] https://www.theregister.com/2025/04/14/windows_update_inetpub/
[10] https://www.theregister.com/2025/04/23/microsoft_365_copilot_agent_refresh/
[11] https://www.theregister.com/2025/04/18/splintering_cve_bug_tracking/
[12] https://www.twingate.com/blog/glossary/symlink-attack
[13] https://whitepapers.theregister.com/
Re: Quality control - yes we’ve heard of it
doubtful so many computers will go to landfill immediately following win10's expiration(non LTSC). Many will just continue to use their OS without new patches for a while. Most software will continue to get updates and probably the most important of which is the browser. Chrome stopped supporting win7 about 3 years past EOL. I think firefox supported Win7 through Firefox ESR for at least another year so 4 years past EOL. Steam stopped Win7 early 2024 looks like it. I suspect Win10 will have an extended life much like Win7 did. I know some more resourceful folks got extra updates out of Win7 by changing to embedded license or something (I never tried that).
While not used for anything too serious I still have at least 4 or 5 systems at home that run Win7, and yes I do do internet things on them occasionally. Most of the time they are off as I don't need them often. I actually bought licenses for Bitdefender earlier this year to install on a couple of Win7 systems for retro gaming(mainly paranoid about "no CD/DVD" cracks of games I own, also used virustotal to scan those).
my main daily driver system of course is Linux and has been since 1998.
Re: Quality control - yes we’ve heard of it
This is probably true of “home” users - both tech-savvy (because they know how to protect themselves somewhat) and non-techy (because they just don’t know). But in business, particularly small businesses, where a security breach could mean bankruptcy, many business owners will want to err on the side of caution. Larger organisations will certainly not want to take the risk, at least not with very careful consideration.
Small business owners don't want to be bothered with technical risk if they can avoid it.
But in any case, if we follow Microsoft's line, that would be to replace all non-upgradeable computers this October. They are encouraging this absolute waste, through greed. They could decide to keep support for all Windows 10 installations, but they don't want that work eating into their bottom line.
If they just waited 5 to 10 more years, those computers would naturally expire anyway.
Two things stand out to me:
1. If they're keeping the LTSC version updated anyway, is it really that much more work (if any) just to keep regular Windows 10 installations updated too? I mean they're writing the software, aren't they?
2. Their insistence that computers can be upgraded is disingenuous at best. Even the message from the readiness tool says that your computer is not compatible with Windows 11 *at the moment*. That sort of implies that it's possible to upgrade the hardware. In most cases, this is impractical. Sure, just upgrade the CPU in your old laptop, easy! Yes, some can be upgraded of course.
The facts of the matter are that they will be prepping the updates anyway, and they're really pushing for people to get a new computer (and making it feel like it's their decision, because it's just too much hassle to upgrade the hardware). It's bullying basically.
The article is about Microsoft's ineptitude in fixing bugs. My point is that they have the resources to make a damn good quality control system. But that's never been at the heart of what they do, has it?
Re: Quality control - yes we’ve heard of it
"perhaps they could invest some money in quality control at Microsoft"
Why would they? They've got users and people like Kevin Beaumont to do it for them. QC costs money if you do it in house.
Re: Quality control - yes we’ve heard of it
With respect, fuck your "modern OS".
We've never needed more than a scheduler, memory management and a file system.
Internet access is useful, though it introduces rather serious security concerns. Notwithstanding, being online by default ought, at least, make it easy to obtain graphical shells. Microsoft's "Presentation Manager" might be one of them.
-A.
Patching the Dumbai way...
... this kind of lazy fixes I've seen already. It would be already bad enough as a temporary workaround, very bad as a fix. But someone at Microsoft should have asked ChatGPT instead of doing his work.
Re: Patching the Dumbai way...
Maybe it's what ChatGPT advised.
if it stops micr$
from infiltrating your personal computer, there will be a fix as soon as they teach the AI bot how. I expect this to be a quicker fix than email.
Inetpub Folder
Heck, I've been seeing this popup and I have been DELETING the dang thing.
Nothing new here...
I've been using mklink /j for inetpub countless times to have the actual folder on D:, i.e. away from the system drive. Other side effects: You can activate deduplication, works wonders on log files and much of web content.
Yes, you could mount a drive in c:\inetpub, but when that drive mount fails for some reasons your inetpub gets filled the normal way. With the junction it is just unusable, and that gets noticed instead of potentially filling C:.
"This one weird trick"
Just one? The whole of Windows is weird.
Quality control - yes we’ve heard of it
Instead of using resources in areas like advertising, advertising, advertising and tracking, perhaps they could invest some money in quality control at Microsoft. While they’re at it, perhaps they could a tually do some consumer research and find out what people need from a modern OS.
This is just abuse. They have the money, they just want more of it. They created this monster, and because of their policies, we have ridiculous situations like hundreds of millions computers going to landfill this year.
It’s happening on their watch. It’s protectionism by any other name.