Service Trusted Path Privilege Escalation in TC 8.01

[CCRDude]

Just was checking my own apps for Service Trusted Path Privilege Escalation and found that I'm fine, but Total Commander is vulnerable.

Steps to reproduce:

1. Copy notepad.exe from Windows folder to C:\Program.exe
2. Set a custom editor in Configuration -> Options -> Operation -> Edit/View to one that resides in C:\Program Files\, like C:\Program Files (x86)\PSPad editor\PSPad.exe. Note that even if you use the UI button to select a file, that path will be listed without quotes.
3. Press F4 on any file.
4. Notepad.exe will open instead of your editor, telling you something about invalid parameters.
5. Use command line wmic process where name="program.exe" get commandline to verify TC is at fault, it tried to call C:\Program Files (x86)\PSPad editor\PSPad.exe c:\mytest.txt, without quotes.

Workaround:
Manually add quotes to editor location entry. Imho this cannot be expected from the user, since the GUI even offers a button to choose the file which does not take care of this issue.

Background:
Is explained in the link above - when paths to be executed have spaces, Windows tries to guess which part is executable and which part is parameter. Bad software can place itself as C:\Program.exe (or another likely location) and get called even by trusted applications that try to call other trusted applications in the wrong way.

[ghisler(Author)]

Yes, please add quotes yourself - TC supports parameters in this F4 command, so it cannot "know" where the command ends and where the parameters start if you don't add quotes.

[MVV]

ghisler, you can add quotes when user uses 'browse' button.

[ghisler(Author)]

That's a good idea, I will add them.