CVE-2023-54331
Unquoted Service Path in Outline 1.6.0 Enables Privilege Escalation
Publication date: 2026-01-13
Last updated on: 2026-02-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | outline | 1.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-54331 is an unquoted service path vulnerability in Outline version 1.6.0. It occurs because the OutlineService executable path is not enclosed in quotes, which allows local attackers to place malicious executables in certain path locations. When the service starts, Windows may execute the malicious code instead of the intended service executable. This leads to arbitrary code execution with elevated system privileges (LocalSystem), enabling attackers to escalate their privileges on the affected system. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow a local attacker with limited privileges to execute arbitrary code with LocalSystem privileges, which is the highest level of system access on Windows. This means the attacker can fully compromise the system, potentially gaining control over all data, system settings, and installed software. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the service configuration for unquoted service paths. Specifically, you can use the Windows Management Instrumentation Command-line (WMIC) to list services with automatic start mode excluding those in the Windows directory, and then query the OutlineService configuration to confirm the unquoted binary path. Commands include: 1. List services with automatic start mode excluding Windows directory: wmic service where "startmode='auto' and pathname not like '%\\Windows\\%'" get name,pathname,startmode 2. Query the OutlineService configuration: sc qc OutlineService These commands help identify if the OutlineService executable path is unquoted, which indicates the presence of the vulnerability. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include correcting the unquoted service path by adding quotes around the OutlineService executable path to prevent malicious code injection. Additionally, ensure that only trusted users have local access to the system, as the vulnerability requires local access to exploit. Applying any available patches or updates from the vendor is also recommended to address the vulnerability. [1, 3]