vendor:
Kite
by:
Ismael Nava
7.8
CVSS
HIGH
Unquoted Service Path
426
CWE
Product Name: Kite
Affected Version From: 1.2020.1119.0
Affected Version To: 1.2020.1119.0
Patch Exists: NO
Related CWE: N/A
CPE: a:kite:kite
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10 64 bits
2020
Kite 1.2020.1119.0 – ‘KiteService’ Unquoted Service Path
Kite 1.2020.1119.0 is vulnerable to an unquoted service path vulnerability. This vulnerability can be exploited by an attacker to gain elevated privileges on the system. The vulnerability exists because the KiteService service is installed with an unquoted service path. An attacker can exploit this vulnerability by placing malicious files in the same directory as the service executable and then executing them with elevated privileges.
Mitigation:
Ensure that all service paths are properly quoted. Additionally, ensure that all services are running with the least privileges necessary.