search

debauchee / barrier

Open-source KVM software
Other
27.49k stars 1.51k forks source link

Unquoted service path on windows #1219

Open petecog opened 3 years ago

petecog commented 3 years ago

Describe the bug I've noticed that the service path created in windows registry is unquoted - which can cause a vulnerability. see https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae for example

To Reproduce

Steps to reproduce the behavior:

  1. install v2.3.3
  2. Inspect HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Barrier\ImagePath

Expected behavior Ideally value should be quoted e.g. "C:\Program Files\Barrier\barrierd.exe" - becuse of the space in 'Program Files'

Desktop (please complete the following information):

shymega commented 3 years ago

Hi. Thanks for the report. Given this is a serious security vulnerability, perhaps it should be reported to an email address to me and the other devs directly - but that's not set up yet. I'll look into that... we have another report as well, so obviously we have some vulns that need looking into. Rest assured, we are looking into this - I'll keep the issue open for now.

Thanks again!

starmaid commented 2 years ago

bumping this, still an issue in 2.4.0 and nessus keeps flagging it