FreeLAN Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in FreeLAN version 2.2 due to an unquoted service path in its Windows service configuration. This flaw allows local attackers to execute arbitrary code by injecting malicious executables into the unquoted binary path. These executables are then executed with elevated LocalSystem privileges when the service starts.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with LocalSystem privileges.

Reproduction

The vulnerability can be reproduced by exploiting the unquoted service path of the FreeLAN service. This can be done by injecting a malicious executable into the path, which will be executed with elevated privileges when the service is started.