THREAT INTELLIGENCE REPORT — CVE-2022-0883

Executive Summary

CVE-2022-0883 is a Windows Unquoted/Trusted Service Paths vulnerability affecting Snow License Manager (SLM) versions 9.x.x prior to 9.20.1. The flaw allows a local attacker with the ability to write to an unquoted service path location to execute arbitrary code with the privileges of the affected Windows service, which typically runs with elevated SYSTEM-level permissions. All installations running SLM version 9.x.x earlier than 9.20.1 are affected and must be patched. Given the vulnerability's local nature and conditions required for exploitation, it carries a CVSS score of 7.3 and has a low probability of being exploited in the wild (EPSS 0.00222).

Technical Analysis

Vulnerability Class Overview

CVE-2022-0883 belongs to the Windows Unquoted/Trusted Service Paths security issue class. This is a well-documented Windows privilege escalation technique that arises from a specific misconfiguration in how Windows service executables are registered and launched.

The Flaw Mechanism

When a Windows service is installed with a path to its executable that contains spaces but is not enclosed in double quotes, Windows uses a specific resolution order to locate the executable file. For example, if the service binary is specified as:

C:\Program Files\Snow Software\SLM\slm_service.exe (without quotes)

Windows will attempt to resolve the path in the following sequential order:

1. C:\Program.exe
2. C:\Program Files\Snow.exe
3. C:\Program Files\Snow Software\SLM\slm_service.exe

If an attacker can place a malicious executable named, for instance, Program.exe or Snow.exe in one of the earlier directory positions in the path hierarchy, the Windows Service Control Manager (SCM) will execute the attacker's binary instead of the legitimate SLM service binary.

Attack Surface

The attack surface for this vulnerability includes:

1. Local file system access — The attacker must have write permissions to one of the "gap" directories along the service path (e.g., ability to drop a file into C:\ or C:\Program Files\). While C:\ is typically locked down with ACLs, other directories may permit writes depending on organizational configuration.

2. Windows service account privileges — The SLM service likely runs with elevated privileges (possibly LocalSystem or a dedicated service account with high privileges). Upon exploitation, the attacker inherits these service privileges.

3. Version scope — All SLM versions 9.x.x prior to 9.20.1 are affected. Snow License Manager is a software asset management (SAM) solution deployed in enterprise environments to track and manage software licenses.

Code-Level Explanation

While the NVD description does not provide specific service executable paths or registry key names, the underlying mechanism is standard Windows behavior. The flaw is entirely a service registration misconfiguration — the unquoted path — rather than a memory safety issue or input validation flaw in SLM's own code. This means the vulnerability class is the misconfiguration itself; any code running under the service context will inherit the elevation.

Insufficient technical detail is available from the NVD description regarding the exact service name, binary path, or registry location. Analysts should retrieve the vendor advisory from Snow for these specifics.

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2022-0883. The following attack chain is inferred from the vulnerability class (Windows Unquoted/Trusted Service Paths) and the general behavior of Windows service loading.

Step 1: Reconnaissance / Target Identification

A local attacker (or a remote attacker who has already achieved low-privilege code execution on the target host) enumerates the list of installed Windows services to identify services whose binary paths contain spaces and are not quoted. Common reconnaissance commands performed in the Windows environment include:

• Querying the Service Control Manager for service configurations (e.g., sc qc <servicename>)
• Enumerating the registry key HKLM\SYSTEM\CurrentControlSet\Services\<service> where the ImagePath value stores the unquoted binary path
• Using built-in Windows utilities or PowerShell to parse service binary paths

The attacker searches for a service like the SLM service where the ImagePath contains spaces without surrounding quotes.

Step 2: Triggering the Flaw

Once the vulnerable service is identified, the attacker checks the directory hierarchy along the unquoted path for a location where write access is permitted. For example, if the service path were C:\Program Files\Snow Software\SLM\service.exe, the attacker would explore whether:

• C:\ or
• C:\Program Files\

allows file creation. If only one directory gap is writable, the attacker can plant a malicious executable there with a name matching the expected intermediate path segment (e.g., Snow.exe for the second directory gap).

Step 3: Payload / Execution Method

The attacker plants a malicious executable (e.g., a reverse shell binary or a payload that adds a new local administrator account) at the writable directory with the correct filename. The payload is crafted to execute when the service starts.

The attacker then needs to initiate service startup. Options include:

• Rebooting the machine (the service auto-starts)
• Restarting the service via sc stop <service> / sc start <service> (requires SERVICE_START and SERVICE_STOP permissions, which some users may hold)
• Waiting for a legitimate service restart cycle

When the Windows Service Control Manager attempts to start the SLM service, it resolves the unquoted path and mistakenly executes the attacker's planted binary with the service account's privileges — typically LocalSystem.

Step 4: Post-Exploitation Impact

Successful exploitation yields:

• Complete system compromise — The attacker gains code execution with SYSTEM privileges
• Persistence — The malicious binary can be configured to reinstall itself or maintain a permanent backdoor
• Lateral movement — With SYSTEM access on the host, the attacker can harvest credentials (SAM, LSASS, cached credentials) and pivot to other machines
• Impact on SLM integrity — The legitimate SLM service can no longer be trusted; software license reporting becomes corrupted or unavailable

Because Snow License Manager is typically deployed on servers in enterprise networks with asset management data, the compromised system may also expose license compliance information and network topology details.

Impact Assessment

CVSS Rationale (Score: 7.3)

The exact CVSS subscores are not published by NVD. However, the 7.3 rating indicates a high-severity vulnerability. The assessment reflects:

• Local attack vector — No network exploitation possible; attacker needs local access or prior code execution
• High attack complexity — Requires specific directory write permissions and service restart control
• Low privilege requirement — Starting attack does not require admin rights
• User interaction — May be required (e.g., system reboot) in some scenarios
• High confidentiality/integrity/availability impact — SYSTEM-level code execution compromises all three

Business Impact

1. Enterprise license management disruption — SLM is responsible for software asset management; a compromised installation could lead to license compliance failure or exposure of licensing data.

2. Privilege escalation for any local user — Any user who can write to a directory along the service path can escalate to SYSTEM, which is a critical risk in multi-user environments such as terminal servers or shared workstations.

3. Compliance risk — Organizations subject to SOX, ISO 27001, or other audit frameworks may face compliance findings if system integrity is compromised.

Affected Systems

• All SLM installations running 9.x.x prior to 9.20.1
• Likely Windows servers where SLM is deployed (SLM includes components that run as Windows services)
• High-risk environments: enterprise workstations with SLM client components, multi-user infrastructure

Blast Radius

• Single host compromise via LOCAL exploitation
• If the host is domain-joined and holds other credentials, the blast radius can expand to the entire Active Directory environment
• No evidence of ransomware or wormable exploitation — EPSS percentile of 13% suggests very low likelihood of in-the-wild exploitation

Detection Guidance

The following detection content is designed to identify conditions leading to CVE-2022-0883 exploitation: unquoted service paths, creation of suspicious executables in directory gaps, and abnormal service start events.

Sigma Rule

title: Suspicious Binary Execution via Unquoted Service Path
id: 7f9c2e4a-33b1-4f9e-a6c2-5f88c3d77a10
status: experimental
description: Detects execution of binaries that may be the result of an unquoted service path hijack (CVE-2022-0883 pattern) for Snow License Manager or similar services.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0883
author: Valters IT Threat Intelligence
date: 2025/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary_name:
        Image|endswith:
            - '\\Program.exe'
            - '\\Snow.exe'
            - '\\Software.exe'
            - '\\SLM.exe'
    selection_suspicious_path:
        Image|contains:
            - 'C:\Program Files\'
        Image|contains|all:
            - '\Snow'
            - '\Software'
    condition: selection_binary_name or selection_suspicious_path
falsepositives:
    - Legitimate executables with identical names in non-standard paths
level: medium
tags:
    - attack.privilege_escalation
    - attack.t1574.009
    - cve.2022-0883

YARA Rule

rule CVE_2022_0883_Unquoted_Service_Path_Exploit {
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects common payload names and patterns used in unquoted service path hijacks against Snow License Manager (CVE-2022-0883)"
        date = "2025-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-0883"
        severity = "high"
        cve = "CVE-2022-0883"

    strings:
        $s1 = "C:\\Program.exe" ascii wide
        $s2 = "C:\\Program Files\\Snow.exe" ascii wide
        $s3 = "C:\\Program Files\\Snow Software\\SLM.exe" ascii wide
        $s4 = "sc create" ascii wide
        $s5 = "ImagePath" ascii wide
        $s6 = "\\Snow\\Software\\" ascii wide
        $m1 = "cmd.exe /c" ascii wide
        $m2 = "powershell -enc" ascii wide
        $m3 = "whoami" ascii wide

    condition:
        uint16(0) == 0x5A4D and // MZ header
        (
            (2 of ($s*) and any of ($m*)) or
            (all of ($s1, $s2, $s3))
        )
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2022-0883 Attempted Exploitation - Unquoted Service Path Payload Download"; flow:established,to_server; content:"Program.exe"; nocase; content:"Snow"; nocase; distance:0; content:".exe"; distance:0; classtype:attempted-admin; sid:20220883; rev:1; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-0883; metadata:created_at 2025_01_15, updated_at 2025_01_15;)

alert http any any -> any any (msg:"CVE-2022-0883 Potential Unquoted Service Path Exploitation - Binary Download"; flow:established,to_server; http.uri; content:"Program.exe"; nocase; content:"Snow"; nocase; distance:0; http.uri; content:".exe"; distance:0; classtype:attempted-admin; sid:20220884; rev:1; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-0883; metadata:created_at 2025_01_15, updated_at 2025_01_15;)

Note: Network-based detection of this vulnerability is inherently limited because exploitation occurs locally. These rules primarily target outbound C2 traffic from a compromised SLM host or downloads of payload files.

Elastic Detection

// Detect creation of executables in suspicious directory locations
sequence by host.name, process.executable
  [file where event.action == "creation" and
   file.name in ("Program.exe", "Snow.exe", "Software.exe", "SLM.exe") and
   file.path : "C:\\*" and
   not file.path : "C:\\Windows\\*" and
   not file.path : "C:\\Program Files\\*\\*\\*\\*"]
  [process where event.action == "start" and
   process.executable in ("C:\\Program.exe", "C:\\Program Files\\Snow.exe",
                          "C:\\Program Files\\Snow Software\\SLM.exe")]

Splunk SPL Query

index=windows earliest=-30d
  (source="WinEventLog:System" OR source="WinEventLog:Security")
  AND (EventCode=7045 OR EventCode=4697)
  AND (Service_File_Name="C:\\Program.exe" OR
       Service_File_Name="C:\\Program Files\\Snow.exe" OR
       Service_File_Name="C:\\Program Files\\Snow Software\\SLM.exe")
  | table _time, host, EventCode, Service_Name, Service_File_Name, Account_Name
  | sort -_time
  | eval alert="Suspicious Service Binary Path - Unquoted Path Hijack (CVE-2022-0883)"

index=windows earliest=-30d sourcetype="WinEventLog:Security"
  (EventCode=4688 AND New_Process_Name IN ("C:\\Program.exe", "C:\\Program Files\\Snow.exe", "C:\\Program Files\\Snow Software\\SLM.exe"))
  OR (EventCode=4688 AND New_Process_Name="C:\\Program Files\\*" AND CommandLine="*")
  | table _time, host, New_Process_Name, Creator_Process_Name, Subject_User_Name
  | sort -_time

Wazuh OSSEC Rule

<group name="windows,sysmon,service,">
  <!--
    CVE-2022-0883 detection: suspicious binary execution via unquoted service path
    Detects process creation of binaries that match typical unquoted path hijack
    payload filenames (Program.exe, Snow.exe) for Snow License Manager.
  -->
  <rule id="200883" level="12">
    <if_sid>92050</if_sid>  <!-- Windows Sysmon process creation -->
    <field name="win.eventdata.image">C:\Program.exe</field>
    <description>CVE-2022-0883: Possible unquoted service path hijack - execution of C:\Program.exe</description>
    <group>sysmon,process_creation,cve_2022_0883,</group>
    <mitre>
      <id>T1574.009</id>
    </mitre>
  </rule>

  <rule id="200884" level="12">
    <if_sid>92050</if_sid>
    <field name="win.eventdata.image">C:\Program Files\Snow.exe</field>
    <description>CVE-2022-0883: Possible unquoted service path hijack - execution of Snow.exe from parent directory</description>
    <group>sysmon,process_creation,cve_2022_0883,</group>
    <mitre>
      <id>T1574.009</id>
    </mitre>
  </rule>

  <rule id="200885" level="10">
    <if_sid>92050</if_sid>
    <field name="win.eventdata.image">C:\Program Files\Snow Software\SLM.exe</field>
    <description>CVE-2022-0883: Possible unquoted service path hijack - execution of SLM.exe from intermediate directory</description>
    <group>sysmon,process_creation,cve_2022_0883,</group>
    <mitre>
      <id>T1574.009</id>
    </mitre>
  </rule>

  <rule id="200886" level="9">
    <if_sid>530</if_sid>  <!-- Windows service installation -->
    <field name="win.eventdata.serviceFileName" type="pcre2">
      (?i)^[a-z]:\\program(\.exe)?\s|\\snow(\.exe)?\s|software\\slm(\.exe)?
    </field>
    <description>CVE-2022-0883: Suspicious service binary path registered (possible unquoted path exploitation)</description>
    <group>service_installation,cve_2022_0883,</group>
    <mitre>
      <id>T1574.009</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 — CLAIMED. A single source (the CNA) claims that the issue is fixed in SLM 9.20.1. This has not been independently confirmed at the time of writing. Organizations should verify the fix directly with Snow support or test the patched version in a staging environment before full deployment.

1. Immediate Mitigations

If immediate patching is not possible:

1. Locate and quote service paths — Identify all SLM-related Windows services and ensure their ImagePath registry values are properly enclosed in double quotes. This can be done by:

   • Checking HKLM\SYSTEM\CurrentControlSet\Services\<SLM service> for the ImagePath value
   • Enclosing the path in quotes if it contains spaces, then restarting the service

2. Harden directory ACLs — Review and restrict write permissions on the following directory hierarchy locations:

   • C:\
   • C:\Program Files\
   • C:\Program Files\Snow Software\ Only SYSTEM, Administrators, and CREATOR OWNER should have write access to these locations.

3. Restrict service restart permissions — Limit which users can stop and start the SLM service via sc or the Services MMC snap-in. The default ACL on services grants SERVICE_START and SERVICE_STOP to local users on many Windows versions — this should be tightened.

4. Monitor the service path — Deploy file integrity monitoring on the directory hierarchy where the SLM service resides to detect unauthorized executables.

5. Application whitelisting — Implement AppLocker or Windows Defender Application Control (WDAC) to block execution of binaries from non-allowlisted paths.

2. Patch / Upgrade Steps

1. Backup the existing SLM installation and associated databases.
2. Upgrade all SLM components to version 9.20.1 or later — this is the vendor-recommended fix.
3. Verify post-upgrade that all service ImagePath entries are properly quoted.
4. Retest the SLM service startup and normal operations.
5. Confirm patch availability with Snow Software support or through the Snow License Manager admin portal.

3. Long-Term Hardening

1. Adopt secure service configuration baseline — Enforce a policy requiring all Windows service binary paths to be quoted. Use Group Policy or Microsoft Defender for Servers to scan for unquoted service paths across the enterprise.

2. Least-privilege deployment — Run SLM services under a least-privilege service account rather than LocalSystem where feasible.

3. Periodic security audits — Include unquoted service path checks in routine vulnerability scanning (many commercial scanners, including Nessus, Qualys, and OpenVAS, include this check).

4. Harden file system ACLs — Restrict write access to C:\ and C:\Program Files\ root directories strictly to SYSTEM and Administrators.

5. Endpoint protection — Deploy EDR solutions that detect process creation anomalies, specifically execution of binaries from unusual paths within the C:\Program Files hierarchy.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2022-0883
2. CVE.org Record — https://www.cve.org/CVERecord?id=CVE-2022-0883 (CNA: Snow)
3. Snow License Manager Vendor Advisory — Refer to Snow Software's official release notes for SLM 9.20.1 (via vendor portal/support)
4. MITRE ATT&CK Technique T1574.009 — Hijack Execution Flow: Path Interception by Unquoted Path — https://attack.mitre.org/techniques/T1574/009/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2022-0883 is NOT listed in the KEV catalog; no evidence of in-the-wild exploitation at the time of writing

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns targeting CVE-2022-0883 have been reported. The EPSS score of 0.00222 (13th percentile of exploited CVEs) indicates a very low probability of active exploitation. No PoC code is publicly available. This vulnerability is best characterized as a local privilege escalation risk that is currently not under active attack but carries residual risk for enterprise environments with multi-user systems or weak file system ACLs.

Report Classification: UNCLASSIFIED // PUBLIC
Report Date: 2025-01-15
Prepared by: Valters IT Threat Intelligence
Version: 1.0
Status: FINAL