CVE-2022-27050
📋 TL;DR
CVE-2022-27050 is an unquoted service path vulnerability in BitComet for Windows that allows local attackers to escalate privileges to SYSTEM level by placing malicious executables in specific directories. This affects Windows systems running vulnerable versions of BitComet Service. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- BitComet Service
📦 What is this software?
Bitcomet by Bitcomet
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege escalation leading to complete system compromise, persistence installation, credential theft, and lateral movement capabilities.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM privileges from a lower privileged account.
If Mitigated
No impact if proper access controls prevent local users from writing to vulnerable directories or if service runs with minimal privileges.
🎯 Exploit Status
Exploitation requires local access and ability to write to directories in the service path. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.6 and later
Vendor Advisory: Not officially published by vendor, but referenced in security research
Restart Required: Yes
Instructions:
1. Download BitComet version 1.8.6 or later from official source. 2. Uninstall current version. 3. Install updated version. 4. Restart system to ensure service updates take effect.
🔧 Temporary Workarounds
Apply proper service path quoting
windowsManually edit the service configuration to use quoted paths
sc config "BitComet Service" binPath="\"C:\Program Files\BitComet\BitComet.exe\""
Restrict directory permissions
windowsRemove write permissions for non-administrative users on vulnerable directories
icacls "C:\Program Files\BitComet" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Uninstall BitComet Service if not required
- Run BitComet Service with minimal privileges using service configuration tools
🔍 How to Verify
Check if Vulnerable:
Check service configuration: sc qc "BitComet Service" and look for unquoted paths containing spacesCheck Version:
Check BitComet about dialog or examine installed program version in Control PanelVerify Fix Applied:
Verify service path is quoted: sc qc "BitComet Service" should show quoted path. Check BitComet version is 1.8.6+📡 Detection & Monitoring
Log Indicators:
- Service control manager events showing BitComet service path changes
- Process creation events showing unexpected executables running from BitComet directories
Network Indicators:
- Unusual outbound connections from SYSTEM-level processes
SIEM Query:
EventID=4688 AND NewProcessName CONTAINS 'BitComet' AND SubjectUserName!='SYSTEM'