Executive Summary

This vulnerability involves an unquoted service path in Small HTTP Server version 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. Because the service path is not properly quoted, a local attacker can place a malicious executable with the same name in a directory that has higher priority in the system's search order. When the service starts, it may execute the malicious file instead of the legitimate one.

This misconfiguration allows the attacker to execute arbitrary code, gain unauthorized access to the system, or disrupt the service.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to arbitrary code execution on the affected system, which means an attacker could run malicious programs with the privileges of the service.

This can result in unauthorized access to sensitive system resources or data, as well as disruption or denial of service by interfering with the normal operation of the Small HTTP Server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an unquoted service path for the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. Detection involves checking the service path configuration for unquoted spaces which can be exploited.

On a Windows system, you can use the following command to check the service path for unquoted spaces:

• sc qc "ServiceName"

Replace "ServiceName" with the actual service name related to Small HTTP Server. Look for paths with spaces that are not enclosed in quotes.

Alternatively, you can use PowerShell to find all services with unquoted paths containing spaces:

• Get-WmiObject win32_service | where { $_.PathName -like '* *' -and $_.PathName -notlike '"*"*' } | select Name, PathName

This command lists services whose executable paths contain spaces but are not quoted, which indicates vulnerability to this issue.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include properly quoting the service path to prevent execution of malicious executables placed in higher priority directories.

Ensure that the service executable path is enclosed in double quotes, for example:

• "C:\Program Files (x86)\shttps_mg\http.exe service"

Additionally, apply the latest security patches by upgrading Small HTTP Server to version 3.06.38 or later, where this vulnerability has been resolved.

Restrict physical and network access to the affected systems to reduce the risk of local exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated remote users to bypass SecurityManager restrictions and access any file outside the configured document root. This unauthorized file access could lead to exposure of sensitive or protected data.

Such unauthorized access and potential data exposure may impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Organizations using the affected Small HTTP Server version 3.06.36 should apply the fixed version 3.06.38 to mitigate this risk and maintain compliance with data protection requirements.

Useful 0 Not Useful 0