Unquoted Path Vulnerability - please fix ASAP

Hello lukg,

just curious, which hmpalert.exe, Intercept X, and OS versions? I'm using it with the on-premise SESC and as far as I can see the paths are correctly quoted. 

Christian

We are using Sophos Endpont Advanced 10.8.10.3 and Sophos Intercept X 2.0.20

The HMPA component's installer was recently updated.  I can only think this was introduced at that point as it wasn't always an issue as QC mentions.  The EDR product even has a query for this named "Unquoted paths in the service registry keys":

SELECT
r.path,
r.data
FROM registry r
WHERE
r.path like 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%\ImagePath'
-- Check for data that looks like a path, does not start with a quote and contains a space
-- Note: If the data has a parameter with a . in it will be incorrectly matched
AND r.data like '%:\%'
AND r.data not like '"%'
AND rtrim(r.data, replace(r.data, '.', '')) LIKE '% %'

I assume it will be fixed at the first opportunity.

The HMPA component's installer was recently updated.  I can only think this was introduced at that point as it wasn't always an issue as QC mentions.  The EDR product even has a query for this named "Unquoted paths in the service registry keys":

SELECT
r.path,
r.data
FROM registry r
WHERE
r.path like 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%\ImagePath'
-- Check for data that looks like a path, does not start with a quote and contains a space
-- Note: If the data has a parameter with a . in it will be incorrectly matched
AND r.data like '%:\%'
AND r.data not like '"%'
AND rtrim(r.data, replace(r.data, '.', '')) LIKE '% %'

I assume it will be fixed at the first opportunity.

I see the hottfix installer was released today - Sophos Central Intercept X, Central Server Intercept X Advanced and Sophos Exploit Prevention cumulative hotfix 

This quotes the ImagePath under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hmpalertsvc