ProtonVPN Unquoted Service Path Vulnerability in WireGuard Service

A vulnerability exists in ProtonVPN version 1.26.0, specifically within its WireGuard service configuration, due to an unquoted service path. This flaw allows local attackers to execute arbitrary code by placing malicious executables in certain file system locations. The exploitation occurs when the service starts up, potentially leading to elevated privileges.

Impact

Exploitation of this vulnerability could allow local attackers to execute arbitrary code with elevated privileges.

Reproduction

The vulnerability can be reproduced by placing a malicious executable in a location that the unquoted service path will access when the WireGuard service is started. The service can then be initiated, which will execute the malicious file with elevated rights.