|
| 1 | +# Icinga Knowledge Base - IWKB000009 |
| 2 | + |
| 3 | +## Short Message |
| 4 | + |
| 5 | +Security Scanner: The remote Windows host has at least one service installed that uses an unquoted service path, which contains at least one whitespace. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service |
| 6 | + |
| 7 | +## Reason |
| 8 | + |
| 9 | +The path pointing to the `icinga-service.exe` is not encapsulated inside double quotes `"` during creation. This might open a possible vulnerability and provide a possible attack vector for attackers gaining access to the machine. In worst case, attackers can place a binary file on the location of the path where the whitespace stops. This binary is then executed with the privileges the service is running with, which could cause a security issue. |
| 10 | + |
| 11 | +You can read this [blogpost](http://www.ryanandjeffshow.com/blog/2013/04/05/the-microsoft-windows-unquoted-service-path-vulnerability/) by Jeff Liford to get a better idea on the problem. |
| 12 | + |
| 13 | +## Solution |
| 14 | + |
| 15 | +This is directly fixed within Icinga for Windows v1.3.2, 1.4.2, v1.5.2 and 1.6.0 during the service creation. If you created the service starting with one of these versions, you are not affected. |
| 16 | + |
| 17 | +If not, please update your environment to a version which includes the fix and start a new PowerShell. Afterwards use this code snippet to re-create the service with all your configuration: |
| 18 | + |
| 19 | +```powershell |
| 20 | +Use-Icinga; |
| 21 | +$IcingaService = Get-CimInstance Win32_Service ` |
| 22 | + | Where-Object { |
| 23 | + $_.Name -eq 'icingapowershell' |
| 24 | + } ` |
| 25 | + | Select-Object Name, StartName, PathName; |
| 26 | +
|
| 27 | +if ($null -ne $IcingaService) { |
| 28 | + $IfWUser = $IcingaService.StartName; |
| 29 | + $IfWPath = $IcingaService.PathName.SubString(0, $IcingaService.PathName.IndexOf(' "')); |
| 30 | +
|
| 31 | + if ($IfWPath[0] -eq '"' -And $IfWPath[-1] -eq '"') { |
| 32 | + return; |
| 33 | + } |
| 34 | +
|
| 35 | + Uninstall-IcingaFrameworkService; |
| 36 | + Install-IcingaFrameworkService -Path $IfWPath -User $IfWUser; |
| 37 | +} |
| 38 | +``` |
| 39 | + |
| 40 | +## Test Vulnerability |
| 41 | + |
| 42 | +If you want to test if the above fix work or if you are affected by this problem, you can run this script: |
| 43 | + |
| 44 | +```powershell |
| 45 | +$IcingaService = Get-CimInstance Win32_Service ` |
| 46 | + | Where-Object { |
| 47 | + $_.Name -eq 'icingapowershell' |
| 48 | + } ` |
| 49 | + | Select-Object Name, StartName, PathName; |
| 50 | +
|
| 51 | +$IfWPath = $IcingaService.PathName.SubString(0, $IcingaService.PathName.IndexOf(' "')); |
| 52 | +
|
| 53 | +if ($IfWPath.Contains('"')) { |
| 54 | + Write-Host -ForegroundColor Green 'Your service installation is secure'; |
| 55 | +} else { |
| 56 | + Write-Host -ForegroundColor Red 'You are possibly affected by a whitespace service vulnerability'; |
| 57 | +} |
| 58 | +``` |
0 commit comments