CVE-2019-25307

Deeper analysis

CVE-2019-25307 is an unquoted service path vulnerability affecting WorkgroupMail 7.5.1, specifically in its Windows service configuration. This flaw, classified under CWE-428, arises from the service binary path not being properly quoted, enabling local privilege escalation. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability with low complexity and local access requirements.

Local attackers with low privileges can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the system's PATH search order. During service startup, the malicious executable runs with LocalSystem privileges, potentially allowing arbitrary code execution, full system compromise, and persistence on the affected Windows host.

Advisories and resources, including those from VulnCheck and an Exploit-DB entry (47523), document the issue and provide proof-of-concept exploitation details. No specific patches or mitigations are detailed in the available references, but practitioners should verify service path configurations in WorkgroupMail installations and apply general unquoted path hardening, such as quoting paths or restricting service directories.

A public exploit is available on Exploit-DB, indicating proof-of-concept exploitation capability, though no widespread real-world attacks have been reported in the provided data.