Disk Savvy Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Disk Savvy version 13.6.14 due to an unquoted service path in its Windows service configuration. This flaw allows local attackers to execute arbitrary code by injecting malicious executables into the service binary path, which are then executed with elevated LocalSystem privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code with elevated privileges.

Reproduction

The vulnerability can be reproduced by installing Disk Savvy version 13.6.14 and then using the Windows Management Instrumentation Command-line (WMIC) tool to query the service configuration. The unquoted service path can be exploited by placing a malicious executable in a location that the service will execute with LocalSystem privileges.