Unquoted Service Path Vulnerability in OSAS Traverse Extension Allows Privilege Escalation

Executive Summary

CVE-2021-47864 is an unquoted service path vulnerability in the OSAS Traverse Extension 11's TravExtensionHostSvc service. Because the service's executable path contains spaces but is not enclosed in quotes, an attacker with local access can place a malicious executable in a location that Windows might mistakenly execute instead of the legitimate service binary. Since the service runs with LocalSystem privileges, this can lead to arbitrary code execution with elevated privileges. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to escalate their privileges by executing malicious code with the same high-level privileges as the TravExtensionHostSvc service, which runs under the LocalSystem account. This means an attacker could gain full control over the affected system, potentially leading to system compromise, data theft, or disruption of services. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking for unquoted service paths, especially for the 'travextensionhostsvc' service. Commands such as 'wmic service get name,pathname,startmode | findstr /i "Auto"' can list services with auto start. Then, filter for service paths that contain spaces but are not enclosed in quotes and do not start with 'C:\Windows\'. Additionally, you can query the specific service configuration using 'sc.exe qc travextensionhostsvc' to inspect the binary path for unquoted spaces. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves correcting the unquoted service path by enclosing the executable path in quotes to prevent path-based code injection. Specifically, update the 'travextensionhostsvc' service configuration to quote the binary path, for example changing it to "C:\Program Files\Open Systems,Inc\TRAVERSE\TRAVERSE.Host.CustomExtensions.exe". This prevents attackers from placing malicious executables in the service path that could be executed with elevated privileges. [1, 3]

Useful 0 Not Useful 0