CVE-2022-50928
📋 TL;DR
BlueSoleilCS 5.4.277 has an unquoted service path vulnerability in its Windows service configuration. This allows local attackers with write access to the parent directory to place malicious executables that will be executed with SYSTEM privileges when the service starts. Only Windows systems running this specific version of BlueSoleilCS are affected.
💻 Affected Systems
- IVT Corporation BlueSoleilCS
📦 What is this software?
Bluesoleilcs by Ivtcorporation
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full SYSTEM privileges on the Windows machine, enabling complete system compromise, data theft, and persistence.
Likely Case
Local attacker with basic user privileges escalates to SYSTEM privileges, gaining full control over the affected system.
If Mitigated
With proper directory permissions and monitoring, exploitation would be detected or prevented, limiting impact to failed privilege escalation attempts.
🎯 Exploit Status
Exploitation requires local access and write permissions to the parent directory (C:\Program Files\IVT Corporation\BlueSoleil\). Public exploit code is available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://web.archive.org/web/20210624054150/http://ivtcorporation.com/
Restart Required: Yes
Instructions:
1. Check vendor website for updated version. 2. If available, download and install updated version. 3. Restart the BlueSoleilCS service or reboot system.
🔧 Temporary Workarounds
Add quotes to service path
windowsManually edit the service configuration to add quotes around the binary path
sc config BlueSoleilCS binPath= "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe"
Restrict directory permissions
windowsRemove write permissions for non-administrative users from the BlueSoleil installation directory
icacls "C:\Program Files\IVT Corporation\BlueSoleil" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Remove BlueSoleilCS from affected systems if not required
- Implement strict access controls on the installation directory to prevent unauthorized writes
🔍 How to Verify
Check if Vulnerable:
Run: sc qc BlueSoleilCS | findstr BINARY_PATH_NAME. Check if the path is unquoted and contains spaces.Check Version:
Check program version in Control Panel > Programs and Features, or check file properties of BlueSoleilCS.exeVerify Fix Applied:
Run: sc qc BlueSoleilCS | findstr BINARY_PATH_NAME. Verify the path is quoted: "C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe"📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service start failures
- Unexpected executables in C:\Program Files\IVT Corporation\BlueSoleil\ directory
Network Indicators:
- No network indicators - local privilege escalation only
SIEM Query:
EventID=7036 AND ServiceName="BlueSoleilCS" AND (EventData contains "stopped" OR EventData contains "started")