CVE-2024-58315
📋 TL;DR
Tosibox Key Service 3.3.0 has an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with SYSTEM privileges. Attackers can place malicious executables in the service path to gain elevated access during service startup or system reboot. This affects systems running Tosibox Key Service 3.3.0 on Windows.
💻 Affected Systems
- Tosibox Key Service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full SYSTEM privileges, enabling complete system compromise, data theft, persistence mechanisms, and lateral movement within the network.
Likely Case
Local user escalates privileges to SYSTEM level, allowing installation of malware, credential harvesting, and bypassing security controls.
If Mitigated
Attack is prevented through proper service configuration, path restrictions, or privilege separation, limiting impact to unauthorized code execution attempts.
🎯 Exploit Status
Exploitation requires local access but is straightforward once access is obtained. Public proof-of-concept details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.tosi.net/
Restart Required: Yes
Instructions:
1. Check Tosibox website for security updates. 2. If patch is available, download and install. 3. Restart the Tosibox Key Service. 4. Verify service path is properly quoted.
🔧 Temporary Workarounds
Quote Service Path
windowsModify the Tosibox Key Service to use a quoted service path in Windows Registry
sc config "Tosibox Key Service" binPath= "\"C:\Program Files\Tosibox\KeyService.exe\""
Restrict Write Permissions
windowsRemove write permissions for non-administrative users on directories in the service path
icacls "C:\Program Files\Tosibox" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to affected systems
- Monitor for suspicious service modifications and unauthorized executable creation in system paths
🔍 How to Verify
Check if Vulnerable:
Check if Tosibox Key Service 3.3.0 is installed and verify service path is unquoted using: sc qc "Tosibox Key Service"Check Version:
Check installed version in Programs and Features or via registry: reg query "HKLM\SOFTWARE\Tosibox" /v VersionVerify Fix Applied:
Verify service path is properly quoted and no unauthorized executables exist in the service path directories📡 Detection & Monitoring
Log Indicators:
- Unexpected service restarts of Tosibox Key Service
- Creation of executables in system paths by non-privileged users
- Failed privilege escalation attempts in security logs
Network Indicators:
- Unusual outbound connections from Tosibox Key Service process
- Lateral movement attempts from affected system
SIEM Query:
EventID=4688 AND ProcessName="Tosibox*" AND SubjectUserName NOT IN ("SYSTEM", "Administrator")🔗 References
- https://packetstormsecurity.com/files/177260/
- https://www.tosi.net/
- https://www.vulncheck.com/advisories/tosibox-key-service-local-privilege-escalation-via-unquoted-service-path
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5812.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5812.php
