Executive Summary

This vulnerability is an unquoted service path issue in the Sandboxie-Plus 5.50.2 Windows service named 'SbieSvc.' Because the service executable path is not enclosed in quotes, a local attacker can place a malicious executable in a location that Windows might mistakenly execute during service startup. This allows the attacker to run arbitrary code with LocalSystem privileges, effectively escalating their privileges on the system. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can allow a local attacker to execute arbitrary code with LocalSystem privileges, which is the highest level of privilege on a Windows system. This means the attacker can gain full control over the affected system, potentially leading to unauthorized access, data manipulation, or disruption of system operations. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

You can detect the vulnerability by checking the service configuration for the SbieSvc Windows service to see if its binary path is unquoted. A suggested command is: sc qc SbieSvc. This command outputs the service configuration, including the executable path. If the path is unquoted (e.g., C:\Program Files\Sandboxie-Plus\SbieSvc.exe without quotes), the system is vulnerable to this issue. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves correcting the unquoted service path by enclosing the executable path in quotes to prevent execution of malicious binaries. Alternatively, ensure that no malicious executables exist in the directories that could be interpreted due to the unquoted path. Applying updates or patches from Sandboxie-Plus, if available, is also recommended to fix the vulnerability. [1, 2]

Useful 0 Not Useful 0