A local privilege escalation vulnerability in SonarQube 8.3.1 allows attackers to execute arbitrary code with SYSTEM privileges, posing a critical risk to host integrity.

This is an unquoted service path vulnerability (CWE-428) where the service executable path contains spaces and lacks quotation marks. A local attacker with sufficient file system permissions can replace the legitimate binary with a malicious one, which the system will execute with highest (SYSTEM) privileges upon service restart.

The ability for a local attacker to gain SYSTEM privileges represents a total compromise of the affected host. This level of access allows for complete control over the operating system, including the ability to install persistent backdoors, exfiltrate sensitive data, or move laterally within the network. Given the CVSS score of 7.8, this flaw constitutes a high-severity risk that requires immediate attention in environments where untrusted local users have access.

Immediate Action: Upgrade the SonarQube installation to a supported, patched version that addresses the unquoted service path configuration. If an update is not immediately feasible, manually enclose the service path in quotes within the Windows Registry.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or unexpected process execution patterns originating from the SonarQube service directory.

Compensating Controls: Implement strict file system permissions on the directory where the SonarQube service binary resides to prevent unauthorized users from modifying or replacing the executable.

Public Exploit Available: Yes, a local exploit proof-of-concept exists via the Exploit-DB entry 48677.

The risk posed by this vulnerability is significant due to the potential for full system compromise. Organizations must prioritize patching or applying the manual configuration fix to ensure the service path is properly quoted and secured against unauthorized binary replacement. Failure to address this flaw leaves the underlying host susceptible to full administrative takeover by a local attacker.