CVE-2023-31747
📋 TL;DR
Wondershare Filmora 12 contains an unquoted service path vulnerability in the NativePushService component. This allows attackers with local access to execute arbitrary code with elevated SYSTEM privileges by placing malicious executables in specific directories. All users running the vulnerable version are affected.
💻 Affected Systems
- Wondershare Filmora
📦 What is this software?
Filmora by Wondershare
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, allowing installation of persistent malware, credential theft, and complete control of the affected system.
Likely Case
Local privilege escalation leading to malware execution, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact if proper endpoint security controls block unauthorized process execution and monitor for privilege escalation attempts.
🎯 Exploit Status
Exploit details published on Packet Storm Security. Requires local access and ability to write to directories with spaces in the service path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found in provided references
Restart Required: Yes
Instructions:
1. Check Wondershare website for security updates. 2. Update to latest Filmora version if patch available. 3. Restart system after update.
🔧 Temporary Workarounds
Apply quotes to service path
windowsManually add quotes around the service executable path in Windows Registry
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NativePushService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Wondershare\Filmora 12\NativePushService.exe\"" /f
Remove vulnerable service
windowsDisable or remove the NativePushService if not required
sc stop NativePushService
sc delete NativePushService
🧯 If You Can't Patch
- Restrict write permissions to directories in the service path (especially those with spaces)
- Implement application whitelisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check if NativePushService exists and has unquoted path: sc qc NativePushService | findstr /i "BINARY_PATH_NAME"Check Version:
Check Filmora version in Help > About or via installed programs listVerify Fix Applied:
Verify service path has quotes: sc qc NativePushService | findstr /i "BINARY_PATH_NAME" and check for surrounding quotes📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4688 (process creation) showing unexpected processes running as SYSTEM from Filmora directories
- Service control manager events for NativePushService modifications
Network Indicators:
- Unusual outbound connections from SYSTEM-level processes
SIEM Query:
source="WinEventLog:Security" EventID=4688 AND NewProcessName="*NativePushService*" AND IntegrityLevel="System"