ActivIdentity Unquoted Service Path Vulnerability in Shared Store Service Allowing Arbitrary Code Execution

A vulnerability exists in ActivIdentity version 8.2 within the 'ac.sharedstore' service, related to an unquoted service path. This flaw enables local attackers to execute arbitrary code by exploiting the unquoted binary path in the Common Files directory. Attackers can inject malicious executables to escalate privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation and execution of arbitrary code with elevated rights.

Reproduction

The vulnerability can be reproduced by injecting a malicious executable into the unquoted service path of 'ac.sharedstore' service. Once the executable is injected, it can be executed to escalate privileges.