Unquoted Service Path Vulnerability in Andrea ST Filters Service

Executive Summary

CVE-2020-37058 is an unquoted service path vulnerability in Andrea ST Filters Service version 1.0.64.7 on Windows. The service executable path is not enclosed in quotes and contains spaces, which allows a local attacker to inject malicious code into the path. When the service starts, this malicious code executes with elevated LocalSystem privileges, potentially leading to full system compromise. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with elevated LocalSystem privileges. A local attacker who can write to a directory in the service path can inject malicious executables that run with high privileges during service startup, potentially resulting in full system compromise including loss of confidentiality, integrity, and availability. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying unquoted service paths in Windows services that start automatically and are not located in the Windows directory. Commands such as Windows Management Instrumentation Command-line (WMIC) and Service Control (sc) can be used to list services and check their executable paths for unquoted spaces. For example, using WMIC: `wmic service get name,pathname,startmode | findstr /i "Auto"` to find services with automatic start mode and then inspecting the paths for unquoted spaces. Using `sc qc <service_name>` can show the binary path of a specific service to verify if it is unquoted. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include correcting the unquoted service path by enclosing the service executable path in double quotes to prevent malicious code injection. This can be done by modifying the service configuration to ensure the path is properly quoted. Additionally, restricting write permissions on directories in the service path can help prevent attackers from placing malicious executables. Ensuring that only trusted users have local access and monitoring for suspicious files in service directories are also recommended. [1, 3]

Useful 0 Not Useful 0