ProtonVPN version 1.26.0 suffers from an unquoted service path vulnerability.
# Exploit Title: ProtonVPN 1.26.0 - Unquoted Service Path
# Date: 22/03/2022
# Exploit Author: gemreda (@gemredax)
# Vendor Homepage: https://protonvpn.com/
# Software Link: https://protonvpn.com/
# Version: 1.26.0
# Tested: Windows 10 x64
# Contact: [email protected]
PS C:UsersEmre> sc.exe qc "ProtonVPN Wireguard"
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: ProtonVPN Wireguard
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:Program Files (x86)Proton TechnologiesProtonVPNProtonVPN.WireGuardService.exe C:ProgramDataProtonVPNWireGuardProtonVPN.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ProtonVPN WireGuard
DEPENDENCIES : Nsi
: TcpIp
SERVICE_START_NAME : LocalSystem
#Exploit:
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:Program.exe" to be run by a privileged program making use of WinExec.
