A local privilege escalation vulnerability in Input Director 1.4.3 allows attackers to execute malicious code with elevated system privileges.

The software utilizes an unquoted service path for its Windows service configuration, which permits a local attacker to place a malicious executable in the path and have it executed by the system during startup or reboot with LocalSystem privileges.

Successful exploitation allows a local user to escalate their privileges to LocalSystem, which is the highest level of authority on a Windows machine. This compromise grants the attacker full control over the affected system, enabling them to install software, modify or delete data, and create new accounts with full administrative rights. Given the CVSS score of 7.8, this poses a significant risk to the integrity and confidentiality of the host environment.

Immediate Action: Update Input Director to a version that properly quotes the service path in the Windows registry, or manually modify the registry to wrap the service path in quotes if an official patch is not applied.

Proactive Monitoring: Monitor Windows system logs for unexpected service installations or modifications, and audit the registry for unquoted service paths using security configuration management tools.

Compensating Controls: Restrict local access to the file system to prevent unauthorized users from placing malicious files in the directory paths used by system services.

Public Exploit Available: Yes, a proof of concept and technical write up are available via ExploitDB (EDB-ID: 48795).

The vulnerability represents a critical risk for any environment utilizing Input Director, as it provides a straightforward path for local privilege escalation. Administrators should audit all installations for the vulnerable version and apply the necessary configuration changes or updates immediately to prevent potential system compromise.