Windows Sensor unquoted path enumeration vulnerability

Products

• Carbon Black EDR

Issue/Introduction

Windows sensor service is represented as C:\WINDOWS\CarbonBlack\cb.exe.  (Mitre: CWE-428: Unquoted Search Path or Element)

Environment

• Carbon Black EDR Windows Sensors: Version 7.3.1 and Lower
• Microsoft Windows OS: Supported Versions

Cause

Windows sensors were designed to not allow spaces in the path.  The current Windows security best practices expects quotes around the path.

Resolution

The Windows sensor service should be stored as "C:\WINDOWS\CarbonBlack\cb.exe" to avoid being flagged by vulnerability scanners and corner cases where an admin could install CarbonBlack in a directory that does include spaces.

Additional Information

• Windows Unquoted Path Enumeration vulnerability was noted in 2013.  The advisories stated, an unquoted service could lead to a user gaining system privileges.  For example, associating  c:\my windows\CarbonBlack\cb.exe to c:\my.exe and sc start carbonblack.  With the full path in quotes this is not possible.
• On modern Windows there are many security measures are in place:
• A user would not have rights to cb.exe. With admin rights, they already have access to negatively affect the system.
• With Tamper Protection detect/protect this should not be an issue.
• EDR Console does not permit spaces in the obfuscated name for cb.exe.
• Vulnerability scans have identified the lack of quotes as a potential vulnerability.
• Following good practices, the service should be within quotes "c:\windows\carbonblack\cb.exe".