Executive brief
Selea CarPlateServer is a traffic control and vehicle license plate recognition software used by law enforcement and parking management systems. The Windows service for CarPlateServer uses an unquoted binary path, allowing a local attacker to place a malicious executable in the system root directory that executes with elevated LocalSystem privileges when the service starts or the system reboots, potentially compromising the entire system.
Technical details
This vulnerability is an unquoted service path issue in the Windows service configuration for Selea CarPlateServer. The vulnerable service binary path is configured without quotation marks (e.g., C:/Program Files/Selea/CarPlateServer/CarPlateService.exe), which allows Windows to search for and execute binaries in parent directories if the path contains spaces. An authorized local user (non-privileged) can exploit this by placing a malicious executable in a location that will be searched before the legitimate service binary, causing it to execute with the LocalSystem privileges of the service. The attack requires local file system write access and knowledge of the system directory structure, but no special elevation is needed initially. Patches or configuration updates from Selea addressing this issue may be available; users should verify with the vendor or apply the quoted path mitigation immediately.
Affected products
- Selea CarPlateServer 4.0.1.6, 4.013, 3.100, 3.005
Timeline
- 2020-11-08: disclosed: Vulnerability discovered and reported
- 2020-12-31: advisory: CVE-2020-36903 assigned
- 2021-01-22: other: Public exploit published (EDB-49453)