Sandboxie Plus 0.7.4 Unquoted Service Path

2021.05.09

Credit: Erick Galindo

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

# Exploit Title: Sandboxie Plus 0.7.4 - 'SbieSvc' Unquoted Service Path
# Discovery by: Erick Galindo 
# Discovery Date: 2020-05-06
# Vendor Homepage: https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.4/Sandboxie-Plus-x64-v0.7.4.exe
# Tested Version: 0.7.4
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es
# Step to discover Unquoted Service Path:

C:\wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i  "Sandboxie Service" | findstr /i /v """
Sandboxie Service    SbieSvc       C:\Program Files\Sandboxie-Plus\SbieSvc.exe                                        Auto 

# Service info

sc qc "SbieSvc"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SbieSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Sandboxie-Plus\SbieSvc.exe
        GRUPO_ORDEN_CARGA  : UIGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Sandboxie Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


#Exploit:

This vulnerability could permit executing code during startup or reboot with the escalated privileges.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Sandboxie Plus 0.7.4 Unquoted Service Path

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.