Executive brief
Suricata is a network security engine that detects and prevents intrusions on Windows systems. When Suricata is installed to a path containing spaces, a local attacker with write access to an earlier directory component can exploit the unquoted service path to execute arbitrary code with system privileges, leading to complete system compromise.
Technical details
The Windows service installation logic in src/win32-service.c passes an unquoted ImagePath to CreateServiceA, violating Windows API requirements for paths containing spaces. An attacker with write access to a parent directory of the installation path can place a malicious executable that Windows will execute with LocalSystem privileges. This requires local access and writable directory on the installation path, but results in privilege escalation from a low-privileged account to SYSTEM.
Affected products
- OISF Suricata before 7.0.17 and 8.0.6
Timeline
- 2026-09-18: disclosed
- 2026: patched: Fixed in versions 8.0.6 and 7.0.17