OSAS Traverse Unquoted Service Path Vulnerability in TravExtensionHostSvc

A vulnerability exists in OSAS Traverse Extension 11 within the TravExtensionHostSvc service, which operates with LocalSystem privileges. This unquoted service path vulnerability allows attackers to inject and execute malicious code by placing executable files in the service's path, potentially leading to elevated system access.

Impact

Exploitation of this vulnerability could allow for unauthorized code execution with elevated privileges, potentially leading to a full system compromise.

Reproduction

The vulnerability can be reproduced by placing an executable file in the unquoted service path of the TravExtensionHostSvc service. Once the executable is in place, the service can be started, which will execute the malicious payload with LocalSystem privileges.