CVE-2021-43454
📋 TL;DR
This CVE describes an Unquoted Service Path vulnerability in AnyTXT Searcher that allows local attackers to escalate privileges by placing a malicious executable in a service path directory. It affects users running the vulnerable version of AnyTXT Searcher on Windows systems where the service runs with elevated privileges.
💻 Affected Systems
- AnyTXT Searcher
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM-level access, allowing complete system compromise, installation of persistent malware, or disabling of security controls.
Likely Case
Local authenticated user gains administrative privileges, enabling lateral movement, data theft, or further exploitation of the compromised system.
If Mitigated
Limited impact if service runs with minimal privileges, proper file permissions restrict write access to service directories, and endpoint protection blocks unauthorized executables.
🎯 Exploit Status
Exploit requires local access to create files in the service path directory. Public exploit code is available and relatively simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2.395 or later
Vendor Advisory: https://anytxt.net/download/
Restart Required: Yes
Instructions:
1. Download latest version from AnyTXT website. 2. Uninstall current version. 3. Install updated version. 4. Restart system to ensure service updates take effect.
🔧 Temporary Workarounds
Apply quotes to service path
windowsModify the service configuration to use quotes around the service executable path
sc config ATService binPath= "\"C:\Program Files\AnyTXT\ATService.exe\""
Restrict directory permissions
windowsSet strict ACLs on the service directory to prevent unauthorized file creation
icacls "C:\Program Files\AnyTXT" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /grant "Users:(OI)(CI)RX"
🧯 If You Can't Patch
- Run the service with minimal required privileges instead of SYSTEM/Administrator
- Implement application whitelisting to prevent execution of unauthorized binaries in service directories
🔍 How to Verify
Check if Vulnerable:
Check if AnyTXT Searcher version 1.2.394 is installed and if the ATService path in Windows Services (services.msc) is unquoted and contains spaces.Check Version:
Check program version in Control Panel > Programs and Features, or examine file properties of ATService.exeVerify Fix Applied:
Verify installed version is 1.2.395 or later, and check that service path in Windows Services is properly quoted.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service path modifications
- Security logs showing privilege escalation attempts
- Process creation logs showing unexpected executables running from service directories
Network Indicators:
- Unusual outbound connections from service account
- Lateral movement attempts from compromised host
SIEM Query:
EventID=4688 AND (NewProcessName contains "AnyTXT" OR NewProcessName contains "ATService") AND SubjectUserName NOT IN ("SYSTEM", "Administrator")