CVE-2023-36658
📋 TL;DR
CVE-2023-36658 is an unquoted service path vulnerability in OPSWAT MetaDefender KIOSK 4.6.1.9996 that allows local attackers to escalate privileges by placing malicious executables in the service path. This affects systems running the vulnerable version of MetaDefender KIOSK on Windows. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- OPSWAT MetaDefender KIOSK
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM-level access, allowing complete system compromise, installation of persistent malware, or disabling of security controls.
Likely Case
Local authenticated users gain administrative privileges, potentially bypassing security restrictions or accessing sensitive data.
If Mitigated
Limited impact with proper access controls, monitoring, and restricted user permissions preventing local code execution.
🎯 Exploit Status
Exploitation requires local access and knowledge of the service path. Unquoted service path vulnerabilities are well-understood attack vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version as per OPSWAT advisory
Vendor Advisory: https://docs.opswat.com/mdkiosk/release-notes/cve-2023-36658
Restart Required: Yes
Instructions:
1. Download latest MetaDefender KIOSK version from OPSWAT portal. 2. Backup current configuration. 3. Install update following vendor instructions. 4. Restart system to apply changes.
🔧 Temporary Workarounds
Apply proper service path quoting
windowsManually edit the service configuration to use quoted paths
sc config "ServiceName" binPath= "\"C:\Program Files\OPSWAT\MetaDefender KIOSK\service.exe\""
Restrict file permissions
windowsSet strict permissions on directories in the service path to prevent unauthorized file creation
icacls "C:\Program Files\OPSWAT" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" /deny "Users:(OI)(CI)(W)"
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for unauthorized file creation in OPSWAT installation directories
🔍 How to Verify
Check if Vulnerable:
Check service configuration using: sc qc "MetaDefender KIOSK Service" and look for unquoted paths containing spacesCheck Version:
Check application version in About dialog or installation directoryVerify Fix Applied:
Verify service path is quoted in service configuration and check installed version matches patched release📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service path modifications
- Unexpected file creation in OPSWAT directories
- Privilege escalation attempts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=7045 AND ServiceName="MetaDefender KIOSK Service" OR ProcessCreation WHERE ImagePath contains "OPSWAT" AND CommandLine contains unusual paths