Kite Unquoted Service Path Vulnerability in KiteService Windows Service

A vulnerability exists in Kite version 1.2020.1119.0 within the KiteService Windows service, characterized by an unquoted service path. This flaw allows local attackers to execute arbitrary code by exploiting the unquoted path in 'C:\Program Files\Kite\KiteService.exe'. Attackers can inject malicious executables to escalate privileges on the system.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with elevated privileges on the affected system.

Reproduction

The vulnerability can be reproduced by injecting a malicious executable into the unquoted service path of the KiteService Windows service. This can be done by exploiting the unquoted path to execute arbitrary code with elevated privileges.