CVE-2022-50917
📋 TL;DR
CVE-2022-50917 is an unquoted service path vulnerability in ProtonVPN's WireGuard service that allows local attackers to execute arbitrary code with elevated privileges. Attackers can place malicious executables in specific file system locations to be executed when the service starts. This affects ProtonVPN users on Windows systems with version 1.26.0 installed.
💻 Affected Systems
- ProtonVPN
📦 What is this software?
Protonvpn by Proton
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM-level privileges and full control of the system, enabling persistence, data theft, and lateral movement.
Likely Case
Local attacker gains elevated privileges to install malware, modify system configurations, or access sensitive data.
If Mitigated
Attack fails due to proper file permissions, application whitelisting, or the service path being properly quoted after patching.
🎯 Exploit Status
Exploitation requires local access to the system and ability to write to file system locations that precede the legitimate service executable in the unquoted path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.26.1 and later
Vendor Advisory: https://protonvpn.com/support/unquoted-service-path-vulnerability/
Restart Required: Yes
Instructions:
1. Update ProtonVPN to version 1.26.1 or later. 2. Restart the system to ensure the updated service configuration takes effect.
🔧 Temporary Workarounds
Manual Service Path Quoting
windowsManually edit the WireGuard service configuration to quote the executable path
sc config "ProtonVPN WireGuard" binPath= "\"C:\Program Files\Proton Technologies\ProtonVPN\wireguard\wireguard.exe\""
sc stop "ProtonVPN WireGuard"
sc start "ProtonVPN WireGuard"
Restrict File System Permissions
windowsSet restrictive permissions on directories preceding the legitimate executable in the service path
icacls "C:\Program" /deny "Users:(OI)(CI)(W)"
icacls "C:\Program Files" /deny "Users:(OI)(CI)(W)"
icacls "C:\Program Files\Proton Technologies" /deny "Users:(OI)(CI)(W)"
🧯 If You Can't Patch
- Uninstall ProtonVPN 1.26.0 and use alternative VPN software
- Implement application whitelisting to prevent execution of unauthorized binaries in the affected directories
🔍 How to Verify
Check if Vulnerable:
Check if ProtonVPN version is 1.26.0 and examine the WireGuard service path with: sc qc "ProtonVPN WireGuard" | findstr BINARY_PATH_NAMECheck Version:
Check ProtonVPN version in the application interface or via: wmic product where "name like 'ProtonVPN%'" get versionVerify Fix Applied:
Verify ProtonVPN version is 1.26.1+ and check that the service path is properly quoted: sc qc "ProtonVPN WireGuard" | findstr BINARY_PATH_NAME📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from directories preceding legitimate ProtonVPN executables
- Service control manager events showing WireGuard service failures or unexpected startups
Network Indicators:
- Unusual outbound connections from SYSTEM-level processes following WireGuard service restarts
SIEM Query:
EventID=4688 AND (NewProcessName contains "C:\\Program" OR NewProcessName contains "C:\\Program Files") AND SubjectUserName="SYSTEM" AND ParentProcessName contains "services.exe"