CWE-428 covers a product that uses a search path containing an unquoted element with whitespace or other separators. That can make it access resources in a parent path.
How it happens
Suppose a program launches C:\Program Files\Acme Tool\run.exe by passing that string, unquoted, to a process creation call. The system has to guess where the program name ends. It may try C:\Program.exe first. If an attacker can write that file, a privileged program runs it.
MITRE notes that someone with file system access can elevate privileges by placing a file such as C:\Program.exe to be run by a privileged program that uses WinExec. Observed cases include a program that did not quote the Program Files path (CVE-2005-1185), misuse of CreateProcess and CreateProcessAsUser allowing "program.exe" style attacks (CVE-2005-2938), and a "Common Files" variant with a malicious common.exe (CVE-2000-1128).
/* Vulnerable: unquoted, contains spaces */
WinExec("C:\\Program Files\\Acme Tool\\run.exe --service", SW_HIDE);
/* Fixed: quote the executable path */
WinExec("\"C:\\Program Files\\Acme Tool\\run.exe\" --service", SW_HIDE);
The same issue shows up in Windows service registrations where the image path is unquoted.
What an attacker gains
Per the record: code execution with the privileges of the program that launches the file, affecting confidentiality, integrity and availability.
How to find it
No detection methods are listed. Search code for process creation calls with string paths, and review service image paths for spaces without quotes.
How to fix it
- Always quote paths that may contain spaces.
- Prefer APIs that take the application name separately from the command line.
- Make sure unprivileged users cannot write to the root of the drive or to parent directories of installed programs.
Quick check
Why does a space matter?
The system may treat the text before the first space as the program and run it, so a file named Program.exe in the drive root can win.
