A local unquoted service path vulnerability in the Inforprograma JumpStart jswpbapi service allows for local privilege escalation to the LocalSystem level.

The application installs the jswpbapi service with an unquoted executable path containing spaces. A local, authenticated attacker can leverage this misconfiguration to place a malicious binary in a parent directory, which the service will execute with LocalSystem privileges upon restart.

Successful exploitation grants an attacker full administrative control over the affected Windows host. Given the service runs with LocalSystem privileges, this vulnerability facilitates complete system compromise, potential data exfiltration, and the installation of persistent backdoors. The CVSS score of 7.8 reflects the high severity of achieving local privilege escalation, which is a critical step in most attack chains.

Immediate Action: Since no official patch is available, administrators must manually modify the service path registry key to include quotes or move the binary to a directory path without spaces.

Proactive Monitoring: Audit Windows services for unquoted paths by running the command: wmic service get name, displayname, pathname, startmode | findstr /i "auto" | findstr /i /v "C:\Windows\" | findstr /i /v """ .

Compensating Controls: Restrict write permissions on the "C:\Program Files (x86)" directory to prevent unauthorized users from placing malicious executables in the path of the vulnerable service.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 47549.

The risk posed by this vulnerability is significant due to the potential for full system compromise. Organizations running JumpStart 0.6.0.0 should prioritize the manual hardening of the service configuration or remove the software if it is not strictly necessary for business operations. Immediate action is required to mitigate the risk of local privilege escalation.