SolarWinds Kiwi CatTools 3.11.8 - Unquoted Service Path

vendor:

Kiwi CatTools

by:

Mert DAS

8.8

CVSS

HIGH

Unquoted Service Path

426

CWE

Product Name: Kiwi CatTools

Affected Version From: 3.11.2008

Affected Version To: 3.11.2008

Patch Exists: No

Related CWE:

CPE: a:solarwinds:kiwi_cattools:3.11.8

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2021

SolarWinds Kiwi CatTools 3.11.8 – Unquoted Service Path

Unquoted Service Path is a vulnerability that occurs when the path of a service contains spaces and is not surrounded by quotation marks. This can allow an attacker to insert their own malicious code in the system root path undetected by the OS or other security applications, which can be executed with the elevated privileges of the application.

Mitigation:

To mitigate this vulnerability, administrators should ensure that all service paths are properly quoted.

Source

Exploit-DB raw data:

# Exploit Title: SolarWinds Kiwi CatTools 3.11.8 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 3.11.8
# Date: 14.10.2021
# Vendor Homepage: https://www.solarwinds.com/
# Tested on: Windows 10

# Step to discover Unquoted Service Path :

--------------------------------------
C:\Users\Mert>sc qc CatTools
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: CatTools
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\CatTools3\nssm.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : CatTools
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
---------------------------------------------

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
----------------------

#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.