CVE-2021-47773
📋 TL;DR
CVE-2021-47773 is an unquoted service path vulnerability in Dynojet Power Core 2.3.0 that allows local authenticated users to execute arbitrary code with elevated SYSTEM privileges. Attackers can place malicious executables in the service's file path to gain Local System access. This affects systems running the vulnerable version of Dynojet Power Core.
💻 Affected Systems
- Dynojet Power Core
📦 What is this software?
Power Core by Dynojet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, allowing complete control over the affected system, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation leading to persistence, credential harvesting, and installation of additional malware on the compromised system.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only allowing execution of low-privilege code.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB. Requires local authenticated access and ability to write to the service path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dynojet.com/
Restart Required: Yes
Instructions:
1. Check Dynojet website for updated version
2. Uninstall vulnerable version
3. Install patched version if available
4. Restart system
🔧 Temporary Workarounds
Quote Service Path
windowsModify the service configuration to use quoted paths for the executable
sc config "DJ.UpdateService" binPath= "\"C:\Program Files\Dynojet\Power Core\UpdateService.exe\""
Restrict Write Permissions
windowsRemove write permissions for non-administrative users on the service directory
icacls "C:\Program Files\Dynojet\Power Core" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Disable or remove the DJ.UpdateService if not required
- Implement strict access controls and monitoring on affected systems
🔍 How to Verify
Check if Vulnerable:
Check if DJ.UpdateService exists and has an unquoted path: sc qc "DJ.UpdateService"Check Version:
Check installed version in Control Panel > Programs and Features or via registry: reg query "HKLM\SOFTWARE\Dynojet\Power Core" /v VersionVerify Fix Applied:
Verify service path is quoted and proper permissions are set on the directory📡 Detection & Monitoring
Log Indicators:
- Service creation/modification events
- Unusual file creation in Dynojet directories
- Process execution with SYSTEM privileges from unusual paths
Network Indicators:
- Unusual outbound connections from systems running Dynojet Power Core
SIEM Query:
EventID=7045 OR (EventID=4688 AND NewProcessName LIKE '%Dynojet%') OR (EventID=4663 AND ObjectName LIKE '%Dynojet%Power Core%')