CVE-2023-0887
📋 TL;DR
This vulnerability in TFTPD64-SE 4.64 involves an unquoted search path issue in the tftpd64_svc.exe service. It allows local attackers to potentially execute arbitrary code with elevated privileges by placing malicious executables in specific directories. Only users running the vulnerable version of TFTPD64-SE on Windows systems are affected.
💻 Affected Systems
- TFTPD64-SE
📦 What is this software?
Tftpd64 by Tftpd64 Project
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Local user gains administrative privileges on the affected system, enabling unauthorized access to sensitive files and system configuration.
If Mitigated
Limited impact with proper access controls and monitoring in place, potentially only allowing local users to disrupt the TFTP service.
🎯 Exploit Status
Exploitation requires local access and knowledge of the service's installation path. The vulnerability is described as difficult to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check for updated version from the vendor. 2. If available, download and install the patched version. 3. Restart the TFTP service or the entire system if required.
🔧 Temporary Workarounds
Modify Service Path
windowsManually edit the service path to include quotes around the executable path
sc config "TFTPD64-SE" binPath= "\"C:\Path\To\tftpd64_svc.exe\""
Restrict Directory Permissions
windowsSet strict permissions on directories in the service path to prevent unauthorized file creation
icacls "C:\Program Files\TFTPD64" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Remove unnecessary local user accounts and restrict local access to TFTP servers
- Implement application whitelisting to prevent execution of unauthorized binaries in service directories
🔍 How to Verify
Check if Vulnerable:
Check if TFTPD64-SE version 4.64 is installed and running as a service with an unquoted path in the service configuration.Check Version:
Check the application version in the GUI or examine the executable properties. For service: sc qc "TFTPD64-SE"Verify Fix Applied:
Verify the service path contains quotes around the executable path and that directory permissions are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unexpected service restarts
- Unauthorized file creation in TFTP installation directories
- Failed service start attempts
Network Indicators:
- Unusual TFTP traffic patterns
- Connection attempts from unexpected local IPs
SIEM Query:
EventID=7045 AND ServiceName="TFTPD64-SE" AND ImagePath NOT CONTAINS '"'