DiskPulse Unquoted Service Path Vulnerability Allowing Privilege Escalation

A vulnerability exists in DiskPulse Enterprise version 13.6.14 due to an unquoted service path in the Windows service configuration. This flaw allows local attackers to execute arbitrary code by exploiting the unquoted path in the service executable. Attackers can inject malicious executables to escalate privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with elevated privileges.

Reproduction

The vulnerability can be reproduced by installing DiskPulse Enterprise version 13.6.14 and then using the Windows Management Instrumentation Command-line (WMIC) tool to query the service configuration. The unquoted service path can be identified, which indicates the presence of the vulnerability. Once the unquoted path is confirmed, malicious executables can be injected into the service path to execute arbitrary code with escalated privileges.