Executive Summary

CVE-2021-47889 is an unquoted service path vulnerability in the SoftrosSpellChecker service of Softros LAN Messenger version 9.6.4. Because the service path contains spaces but lacks quotation marks, a local attacker with limited privileges can place a malicious executable in a higher-level directory within the service path. When the service starts, it may execute this malicious executable, allowing the attacker to run arbitrary code and escalate their privileges on the system. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to execute arbitrary code with elevated privileges by exploiting the unquoted service path. This can lead to privilege escalation, compromising the confidentiality, integrity, and availability of the affected system. An attacker could gain control over the system, potentially leading to unauthorized access, data manipulation, or disruption of services. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unquoted service paths in Windows services, specifically the 'SoftrosSpellChecker' service. You can query Windows Management Instrumentation (WMI) or use the Service Control Manager (SC) to identify services with unquoted paths that start automatically but are not located in the Windows directory. For example, you can use the following command in an elevated command prompt or PowerShell to list services with unquoted paths: PowerShell: Get-WmiObject win32_service | Where-Object { $_.PathName -like '* *' -and $_.PathName -notlike '"*"*' } | Select-Object Name, PathName, StartMode Or using SC and findstr: sc qc SoftrosSpellChecker Then check if the executable path is unquoted and contains spaces, such as: C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe This method helps detect the unquoted service path vulnerability that can be exploited for privilege escalation. [2]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the service path to include quotation marks around the executable path to prevent execution of malicious executables placed in the path. Specifically, modify the 'SoftrosSpellChecker' service path to be quoted, for example: "C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe" Alternatively, ensure that no untrusted executables exist in any directories in the service path hierarchy. Restrict write permissions on the directories in the service path to prevent attackers from placing malicious executables. Also, consider updating Softros LAN Messenger to a version where this vulnerability is fixed if available. [1, 2]

Useful 0 Not Useful 0