Microsoft Windows Unquoted Service Path Enumeration

Overview

The Microsoft Windows unquoted service path enumeration vulnerability arises when system services are installed with executable paths that are not enclosed in quotation marks. This flaw can be exploited by attackers to execute arbitrary code with elevated privileges if they can place a malicious executable on the path of the affected service.

• Severity: High

Impact

If exploited, this vulnerability can lead to unauthorized privilege escalation on the affected system. Attackers could potentially gain administrative access, allowing them to install programs, view, change or delete data or create new accounts with full user rights. This poses a significant risk to organizational security and can compromise the integrity and availability of critical systems.

Cause

This vulnerability is caused by improper path handling during service installation. If a service path is specified without quotes and contains spaces, Windows may attempt to execute any executable present in a path substring. For example, if the path is C:\Program Files\My App\service.exe, Windows might attempt to execute C:\Program.exe if present.

Solution

To mitigate this vulnerability, you should ensure that all service paths are correctly quoted.

Manual Correction:

1. Open the Registry Editor (regedit.exe).
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
3. Browse through the subkeys and check the ImagePath for each service
4. If the path is unquoted and contains spaces, modify it by adding quotation marks around the full path.

Automated Correction:

Use a PowerShell script to automatically identify and correct unquoted service paths across the system:

Get-WmiObject Win32_Service | 
Where-Object {$_.PathName -like '*\* *' -and $_.PathName -notlike '"*"*'} |
ForEach-Object {
  $path = '"' + $_.PathName + '"'
  Set-ItemProperty -Path ("HKLM:\SYSTEM\CurrentControlSet\Services\" + $_.Name) -Name 'ImagePath' -Value $path
  Write-Output "Corrected path for service: $($_.DisplayName)"
}

Best Practices:

• Regularly audit service installation scripts and deployment procedures to ensure paths are correctly quoted.
• Employ application whitelisting to restrict which executables can run, minimizing the risk from this vulnerability.

Examples

N/A

References

• InfoSec Governance LTD - How to fix the Windows unquoted service path vulnerability
• Tenable - Microsoft Windows Unquoted Service Path Enumeration

Additional Resources

N/A