Executive Summary

[{'type': 'paragraph', 'content': "The vulnerability in BlackMoon FTP Server version 3.1.2.1731 is an unquoted service path issue on Windows platforms. The service's binary path contains spaces but is not enclosed in quotes, which allows local users to exploit the path by inserting malicious executables into certain directories."}, {'type': 'paragraph', 'content': 'When the service starts or the system reboots, the operating system may incorrectly interpret the unquoted path and execute the malicious code with the elevated privileges of the BlackMoon FTP Service, which runs under the LocalSystem account.'}, {'type': 'paragraph', 'content': 'This means a local attacker with write access to parts of the system path can escalate their privileges by executing arbitrary code with high system permissions.'}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to execute arbitrary code with elevated system privileges, specifically with the LocalSystem account permissions.

Such privilege escalation can lead to unauthorized control over the affected system, enabling the attacker to install malware, access sensitive data, modify system configurations, or disrupt services.

Because the exploit requires local access and the ability to write to directories in the system path, it primarily impacts environments where untrusted users have some level of local access.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the service configuration for unquoted service paths. Specifically, you can use the Windows Service Control Manager command to query the service configuration and inspect the binary path.

• Run the command: sc qc BMFTP-RELEASE

If the binary path shown is not enclosed in quotes and contains spaces (e.g., C:\Program Files (x86)\Selom Ofori\BlackMoon FTP Server\FTPService.exe), the service is vulnerable to this unquoted service path issue.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves correcting the unquoted service path by enclosing the entire binary path in quotes to prevent the system from misinterpreting the path and executing malicious code.

Alternatively, ensure that no untrusted users have write permissions to any directories in the service path to prevent insertion of malicious executables.

A recommended step is to update or patch the BlackMoon FTP Server to a version where this vulnerability is fixed, if available.

Useful 0 Not Useful 0