exacqVision 9.8 Unquoted Service Path Privilege Escalation

`  
exacqVision 9.8 Unquoted Service Path Privilege Escalation  
  
  
Vendor: Exacq Technologies, Inc.  
Product web page: https://www.exacq.com  
Affected version: 9.8.4.150001  
  
Summary: The exacqVision VMS (Video Management System) software records surveillance  
video from thousands of IP camera models and displays on a free Windows, Linux or OSX  
client software, web browser or mobile device.  
  
Desc: The application suffers from an unquoted search path issue impacting the services  
'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' for Windows deployed as part of  
exacqVision software application. This could potentially allow an authorized but non-privileged  
local user to execute arbitrary code with elevated privileges on the system. A successful  
attempt would require the local user to be able to insert their code in the system root  
path undetected by the OS or other security applications where it could potentially be  
executed during application startup or reboot. If successful, the local user's code would  
execute with the elevated privileges of the application.  
  
Tested on: Microsoft Windows 7 Professional SP1 (EN)  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2019-5515  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5515.php  
  
  
30.01.2019  
  
--  
  
  
C:\Windows\system32>sc qc exacqVisionServer  
[SC] QueryServiceConfig SUCCESS  
  
SERVICE_NAME: exacqVisionServer  
TYPE : 10 WIN32_OWN_PROCESS  
START_TYPE : 2 AUTO_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME : C:\Program Files (x86)\exacqVision\Server\exacqd.exe  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : exacqVision Server  
DEPENDENCIES : eventlog  
: w32time  
SERVICE_START_NAME : LocalSystem  
  
  
  
C:\Windows\system32>sc qc dvrdhcpserver  
[SC] QueryServiceConfig SUCCESS  
  
SERVICE_NAME: dvrdhcpserver  
TYPE : 10 WIN32_OWN_PROCESS  
START_TYPE : 3 DEMAND_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME : C:\Program Files (x86)\exacqVision\Server\opendhcpserver.exe  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : exacqVision DHCP Service  
DEPENDENCIES :  
SERVICE_START_NAME : NT Authority\NetworkService  
  
  
  
C:\Windows\system32>sc qc mdnsresponder  
[SC] QueryServiceConfig SUCCESS  
  
SERVICE_NAME: mdnsresponder  
TYPE : 10 WIN32_OWN_PROCESS  
START_TYPE : 2 AUTO_START  
ERROR_CONTROL : 1 NORMAL  
BINARY_PATH_NAME : C:\Program Files (x86)\exacqVision\Server\mDNSResponder.exe  
LOAD_ORDER_GROUP :  
TAG : 0  
DISPLAY_NAME : exacqVision mDNS Service  
DEPENDENCIES :  
SERVICE_START_NAME : LocalSystem  
  
`