Unquoted Service Path in VIVE Runtime Allows Privilege Escalation

Executive Summary

CVE-2022-50918 is an unquoted service path vulnerability in the VIVE Runtime Service version 1.0.0.4, specifically affecting the ViveAgentService. Because the service's binary path contains spaces but is not enclosed in quotes, a local attacker can place malicious executables in certain directories along the service path. When the service starts, it may execute these malicious files with elevated LocalSystem privileges, allowing the attacker to run arbitrary code with high system privileges. [1, 4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with low privileges to escalate their privileges to LocalSystem by placing a malicious executable in the service path. This can lead to arbitrary code execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected system. The attacker can gain full control over the system, potentially installing malware, stealing data, or disrupting system operations. [1, 4]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking for unquoted service paths related to the VIVE Runtime Service, specifically the 'ViveAgentService'. On a Windows system, use the command: sc qc ViveAgentService to query the service configuration and inspect the binary path for missing quotes. Additionally, you can use PowerShell to list services with unquoted paths containing spaces, for example: Get-WmiObject win32_service | Where-Object { $_.PathName -match ' ' -and $_.PathName -notmatch '"' } | Select-Object Name, PathName. This helps identify if the ViveAgentService or other services have unquoted paths that could be exploited. [1, 4]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include correcting the unquoted service path by enclosing the entire binary path in double quotes to prevent execution of malicious executables. For the ViveAgentService, update the service configuration to use a quoted path such as "C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe". Additionally, restrict write permissions on directories in the service path (e.g., "C:\Program Files (x86)\VIVE\") to prevent local attackers from placing malicious executables. Applying any available patches or updates from the vendor is also recommended. [1, 4]

Useful 0 Not Useful 0