Quoted Service Path Enforcement (Windows)
Description
Ensures all Windows service executable paths and scheduled task binaries are enclosed in double quotes when they contain spaces, preventing unquoted search path interception attacks. When a service binary path like C:\Program Files\My App\service.exe is registered without quotes, Windows tries to execute C:\Program.exe, then C:\Program Files\My.exe, then C:\Program Files\My App\service.exe in order. An attacker who can write to C:\ or C:\Program Files\ can place a malicious executable that runs as SYSTEM before the intended service binary. Remediation requires auditing all service paths and scheduled task paths, enclosing them in double quotes, and enforcing filesystem ACLs preventing non-admin writes to path prefix directories. Complements CME-507 (Secure Dynamic Linker Configuration) which addresses the analogous Linux attack surface (LD_PRELOAD, RPATH injection).
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Service paths are properly quoted so Windows does not attempt intermediate path resolution; the attacker must find a different privilege escalation vector since the unquoted path interception technique is eliminated |
| Privileges Required (PR) | L → H | With filesystem ACLs preventing writes to path prefix directories (C:\, C:\Program Files\), low-privileged users cannot place interception binaries even if an unquoted path remains |
CWE Relationships
Verification
Enumerate all Windows services and scheduled tasks with unquoted paths containing spaces, and verify filesystem ACLs on path prefix directories
# Expected: No services returned (all paths properly quoted or space-free)
# Expected: No output (no unquoted paths with spaces)
# Expected: No write permissions for BUILTIN\Users on path prefix directories