CVE-2022-23909
📋 TL;DR
This CVE describes an unquoted service path vulnerability in Sherpa Connector Service that allows local attackers to escalate privileges by placing a malicious executable in the service path. It affects systems running vulnerable versions of Sherpa Connector Service. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- Sherpa Connector Service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM/administrator privileges, enabling complete system compromise, persistence, and lateral movement.
Likely Case
Local user with limited privileges escalates to administrative rights, potentially installing malware or accessing sensitive data.
If Mitigated
With proper access controls and monitoring, exploitation attempts are detected and blocked before privilege escalation occurs.
🎯 Exploit Status
Exploitation requires local access and ability to write to C:\Program Files\Sherpa Software\ directory. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: Yes
Instructions:
1. Check for updated version from vendor
2. If patch available, download and install
3. Restart affected service or system
4. Verify service path is properly quoted
🔧 Temporary Workarounds
Quote Service Path
windowsModify the service configuration to use quoted service path
sc config "SherpaConnectorService" binPath= "\"C:\Program Files\Sherpa Software\SherpaConnectorService.exe\""
Restrict Directory Permissions
windowsSet proper ACLs on Sherpa Software directory to prevent unauthorized writes
icacls "C:\Program Files\Sherpa Software" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from writing to program directories
- Monitor for suspicious file creation in C:\Program Files\Sherpa Software\ directory
🔍 How to Verify
Check if Vulnerable:
Check if SherpaConnectorService.exe service path is unquoted: sc qc "SherpaConnectorService" | findstr BINARY_PATH_NAMECheck Version:
Check file properties of SherpaConnectorService.exe or look in installed programs listVerify Fix Applied:
Verify service path is quoted and directory permissions are restricted📡 Detection & Monitoring
Log Indicators:
- File creation events in C:\Program Files\Sherpa Software\
- Service restart events for SherpaConnectorService
Network Indicators:
- No network indicators - local privilege escalation only
SIEM Query:
EventID=4688 AND (NewProcessName LIKE '%Sherpa.exe%' OR ParentProcessName LIKE '%SherpaConnectorService.exe%')🔗 References
- http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
- https://github.com/netsectuna/CVE-2022-23909
- http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
- https://github.com/netsectuna/CVE-2022-23909
