CVE-2023-3842
📋 TL;DR
This vulnerability in Pointware EasyInventory 1.0.12.0 involves an unquoted search path in the Easy2W.exe executable, allowing local attackers to execute arbitrary code by placing malicious files in directories with spaces in their names. It affects users running the vulnerable version on Windows systems with local access to the installation directory. The vendor has not responded to disclosure attempts.
💻 Affected Systems
- Pointware EasyInventory
📦 What is this software?
Easyinventory by Pointware
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM-level access, enabling complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local attackers gain code execution with the privileges of the user running EasyInventory, potentially leading to lateral movement within the network.
If Mitigated
Limited impact if proper access controls prevent unauthorized local users from writing to the installation directory.
🎯 Exploit Status
Exploitation requires local access and ability to write to directories in the search path. No public exploit code is currently known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or discontinuing use of the software.
🔧 Temporary Workarounds
Quote Executable Path
windowsModify shortcuts or scripts to use quoted paths when launching Easy2W.exe
Change shortcuts from 'C:\Program Files (x86)\EasyInventory\Easy2W.exe' to '"C:\Program Files (x86)\EasyInventory\Easy2W.exe"'
Restrict Directory Permissions
windowsSet strict permissions on the EasyInventory installation directory to prevent unauthorized writes
icacls "C:\Program Files (x86)\EasyInventory" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Remove or restrict local user access to systems running EasyInventory
- Monitor for unauthorized file creation in the EasyInventory directory and parent directories
🔍 How to Verify
Check if Vulnerable:
Check if EasyInventory 1.0.12.0 is installed and if Easy2W.exe is launched with unquoted paths in shortcuts or scriptsCheck Version:
Check the version in Help > About within the EasyInventory application or examine the executable propertiesVerify Fix Applied:
Verify that all references to Easy2W.exe use quoted paths and directory permissions prevent unauthorized writes📡 Detection & Monitoring
Log Indicators:
- Unexpected process creation from Easy2W.exe parent directories
- File creation events in EasyInventory directory by unauthorized users
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process creation where parent directory contains spaces and executable name matches patterns like *Easy2W.exe