A local privilege escalation vulnerability in ForensiT AppX Management Service 2.2.0.4 allows attackers to gain system level access by injecting malicious code into an unquoted service path.

The application suffers from an unquoted service path vulnerability (CWE-428) where the service binary path contains spaces and lacks quotation marks. This allows a low privileged local user to place a malicious executable in the path, which the Windows service will then execute with LocalSystem privileges upon startup.

The ability for a low privileged user to gain LocalSystem privileges represents a critical security compromise. This escalation allows an attacker to bypass all OS level restrictions, potentially leading to full system takeover, persistent backdoor installation, and unauthorized access to sensitive data. The CVSS score of 7.8 reflects the high severity of this local privilege escalation vector.

Immediate Action: Update to the latest version of the ForensiT AppX Management Service provided by the vendor to remediate the service path configuration.

Proactive Monitoring: Monitor system logs for unexpected service restarts or the creation of new, unauthorized executables within the application installation directories.

Compensating Controls: If an update is not immediately feasible, administrators can manually correct the service path by adding the necessary quotation marks in the Windows Registry under the service configuration key.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 48821).

Given the availability of public exploit material, this vulnerability poses a significant risk to internal host security. Administrators should prioritize verifying their service configurations and applying the vendor patch immediately to prevent potential privilege escalation by malicious local actors.