Executive Summary

CVE-2020-36903 is an unquoted service path vulnerability in Selea CarPlateServer versions up to 4.0.1.6 on Windows. The service's executable path is not enclosed in quotes, which allows a local, authorized but non-privileged user to place a malicious executable in a directory within the system root path. When the service starts or the system reboots, Windows may incorrectly interpret the unquoted path and execute the attacker's code with elevated LocalSystem privileges, leading to local privilege escalation. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with limited privileges to escalate their privileges to LocalSystem level by exploiting the unquoted service path. This means the attacker can execute arbitrary code with the highest system privileges, potentially gaining full control over the affected system, which can lead to unauthorized access, data manipulation, or disruption of services. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the Windows service configuration for unquoted service paths related to Selea CarPlateServer. Specifically, you can query the service binary path to see if it is unquoted. For example, use the command: sc qc "Selea CarPlateServer" and inspect the BINARY_PATH_NAME field. If the path is not enclosed in quotes and contains spaces, it is vulnerable to this issue. [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enclosing the service binary path in quotes to prevent the unquoted service path vulnerability. Alternatively, update the Selea CarPlateServer software to a fixed version where this issue has been addressed. Additionally, restrict local user permissions to prevent unauthorized users from placing malicious executables in the system root path. Reboot the system or restart the service after applying fixes to ensure the changes take effect. [2, 3]

Useful 0 Not Useful 0