Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation.
This issue is fixed in versions 8.0.6 and 7.0.17.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 8
https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e
security-advisories@github.com
https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38
security-advisories@github.com
https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d
security-advisories@github.com
https://github.com/OISF/suricata/pull/15676
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-7.0.17
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
security-advisories@github.com
https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp
security-advisories@github.com
https://redmine.openinfosecfoundation.org/issues/8600
security-advisories@github.com