A high-severity unquoted service path vulnerability in MiniTool ShadowMaker allows local users to achieve privilege escalation via arbitrary code execution.

The vulnerability stems from an unquoted service path in the MTAgentService executable. Because the path contains spaces and lacks quotation marks, a local attacker with standard privileges can place a malicious executable in a parent directory to intercept the service load process, resulting in code execution with LocalSystem privileges.

Successful exploitation of this vulnerability allows a local user to gain full control over the affected host system. Given the CVSS score of 7.8, this represents a significant risk to confidentiality, integrity, and availability. Compromise of an administrative agent service can lead to full system takeover, unauthorized access to sensitive backup data, and potential lateral movement within the network.

Immediate Action: Upgrade to the latest version of MiniTool ShadowMaker where this vulnerability has been addressed. If an update is not immediately feasible, manually quote the service path in the Windows Registry for the MTAgentService.

Proactive Monitoring: Monitor system logs for unauthorized service installations or modifications to service configuration parameters. Review process execution logs for instances where the MTAgentService spawns unexpected child processes.

Compensating Controls: Implement strict file system permissions on the C:\Program Files directory to prevent unauthorized users from creating files or directories in the path of the vulnerable service.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 49336).

Organizations utilizing MiniTool ShadowMaker must prioritize updating to a patched version to eliminate the unquoted service path risk. Given the availability of a public proof-of-concept, the window for remediation is narrow, and administrative teams should verify that all instances are updated or hardened immediately to prevent local privilege escalation.