Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path

vendor:

Disk Sorter Server

by:

BRushiran

5.5

CVSS

MEDIUM

Unquoted Service Path

428

CWE

Product Name: Disk Sorter Server

Affected Version From: 13.6.12

Affected Version To: 13.6.12

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 Enterprise 64 bits

2021

Disk Sorter Server 13.6.12 – ‘Disk Sorter Server’ Unquoted Service Path

The Disk Sorter Server software version 13.6.12 is vulnerable to an unquoted service path vulnerability. This vulnerability occurs when the service path is not surrounded by quotation marks. An attacker with local access to the system could potentially exploit this vulnerability to execute arbitrary code with elevated privileges.

Mitigation:

To mitigate this vulnerability, the vendor should ensure that the service path is properly quoted in the software code.

Source

Exploit-DB raw data:

 # Exploit Title: Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path
# Discovery by: BRushiran
# Date: 15-06-2021
# Vendor Homepage: https://www.disksorter.com
# Software Links: https://www.disksorter.com/setups_x64/disksortersrv_setup_v13.6.12_x64.exe
# Tested Version: 13.6.12
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Sorter Server   Disk Sorter Server   C:\Program Files\Disk Sorter
Server\bin\disksrs.exe   Auto

C:\>sc qc "Disk Sorter Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Sorter Server
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Sorter
Server\bin\disksrs.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Disk Sorter Server
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem