An unquoted service path vulnerability in the Sandboxie-Plus SbieSvc service allows local attackers to escalate privileges to LocalSystem.

The application utilizes an unquoted service path for the SbieSvc Windows service. This flaw allows a local, low-privileged attacker to place a malicious executable in a parent directory of the service path, which the system will then execute with elevated LocalSystem privileges upon service startup.

The ability for a local user to gain LocalSystem privileges represents a critical security failure, as it allows for complete control over the affected host. This vulnerability could be leveraged to bypass security controls, exfiltrate sensitive data, or install persistent malware. With a CVSS score of 8.4, this issue presents a high risk to the confidentiality, integrity, and availability of any system running the vulnerable software.

Immediate Action: Update Sandboxie-Plus to the latest available version provided by the vendor to resolve the service path configuration.

Proactive Monitoring: Monitor system logs for the execution of unexpected binaries originating from the Sandboxie-Plus installation directories, particularly those occurring during service startup.

Compensating Controls: Ensure that standard users lack write permissions to the C:\Program Files directory and its subdirectories, as this prevents the placement of malicious executables required to exploit this specific vulnerability.

Public Exploit Available: Yes, a public exploit exists as documented by the Exploit Database (EDB-ID 50819).

Given the availability of a public exploit and the high potential for privilege escalation, organizations should treat this vulnerability with urgency. Administrators must verify the installation path of the SbieSvc service and apply the vendor-provided security updates immediately to mitigate the risk of local system compromise.