Microsoft Windows Unquoted Service Path Enumeration

jkeippel's Avatar

jkeippel

19 May, 2017 10:38 PM

We had a Nessus finding internally regarding "Microsoft Windows Unquoted Service Path Enumeration". More information about the vulnerability is here: https://www.commonexploits.com/unquoted-service-paths/

And the Nessus article is here: https://www.tenable.com/plugins/index.php?view=single&id=63155

I just happened to be setting up a Windows Service deployment step and noticed that when Octopus creates Windows Services, it does so without the quotes. Is this something that you expect to fix in a future release? Is there a way to work around this within Octopus? I'm guessing I'll need to add a PowerShell script step to alter the execution path, but I'm hoping there is a work around I've overlooked. Thanks!

  1. Support Staff 1 Posted by Rob Erez on 22 May, 2017 01:47 AM

    Rob Erez's Avatar

    Hi,
    It looks like you may have stumbled across an issue that has come about as a result of an earlier fix made regarding quotes around paths. I have created a GitHub ticket to fix this problem. You can see where this missing quotes are in the open source Calamari project which is used by Octopus to execute the scripts on the Tentacles. Because this path is resolved and used in the same script provided in the above link, there is not much you can do at the moment to work around it. Since this is a potential vulnerability I will raise it up with the team to get some priority on it.
    Thanks for bringing this to our attention, Let me know if I can be of any further assistance.
    Cheers,
    Rob

Reply to this discussion

Internal reply

Formatting help / Preview (switch to plain text) No formatting (switch to Markdown)

Attaching KB article:

»

Attached Files

You can attach files up to 10MB

If you don't have an account yet, we need to confirm you're human and not a machine trying to post spam.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac