CVE-2022-50921
📋 TL;DR
CVE-2022-50921 is an unquoted service path vulnerability in WOW21 5.0.1.9 that allows local attackers to execute arbitrary code with SYSTEM privileges. Attackers can place malicious executables in paths that get executed during service startup. This affects systems running the vulnerable WOW21 software version.
💻 Affected Systems
- WOW21
📦 What is this software?
Wow21 by Wow21
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with LocalSystem privileges leading to persistent backdoor installation, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM privileges on the compromised host.
If Mitigated
Limited impact if proper file permissions restrict write access to system directories and service paths are properly quoted.
🎯 Exploit Status
Exploit requires local access to the system. Proof of concept code is publicly available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://web.archive.org/web/20220220170535/https://wow21.life/
Restart Required: Yes
Instructions:
1. Check vendor website for updated version. 2. If patch available, download and install. 3. Restart the WOW21 service. 4. Verify the service path is now properly quoted.
🔧 Temporary Workarounds
Quote Service Path
windowsManually edit the service configuration to add quotes around the binary path
sc config "WOWService" binPath= "\"C:\Program Files\WOW21\wowservice.exe\""
Restrict Directory Permissions
windowsSet strict ACLs on directories in the service path to prevent unauthorized file creation
icacls "C:\Program Files\WOW21" /deny Everyone:(OI)(CI)W
🧯 If You Can't Patch
- Remove unnecessary write permissions from directories in the service path hierarchy
- Monitor for unauthorized file creation in system directories and service paths
🔍 How to Verify
Check if Vulnerable:
Run: sc qc "WOWService" and check if the binary path contains spaces without quotesCheck Version:
Check WOW21 application version in Control Panel > Programs and Features or via the application interfaceVerify Fix Applied:
Run: sc qc "WOWService" and verify the binary path is properly quoted with double quotes📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service startup failures
- Unexpected process execution from system directories
- File creation events in service path directories
Network Indicators:
- Unusual outbound connections from SYSTEM processes
- Lateral movement attempts from the affected host
SIEM Query:
EventID=4688 AND NewProcessName="*\WOW21\*" AND SubjectUserName="SYSTEM"