CVE-2019-25305: JumpStart Privilege Escalation Flaw

CVE-2019-25305 Overview

CVE-2019-25305 is an unquoted service path vulnerability (CWE-428) affecting JumpStart version 0.6.0.0. The jswpbapi service, which runs with LocalSystem privileges, contains a service path that includes spaces but is not properly enclosed in quotation marks. This configuration flaw allows local attackers to escalate privileges by placing a malicious executable in a location that Windows will execute before the intended service binary.

Critical Impact

Attackers with local access can achieve SYSTEM-level privilege escalation by exploiting the unquoted service path, potentially gaining complete control over the affected system.

Affected Products

• JumpStart 0.6.0.0
• Systems running the jswpbapi service with LocalSystem privileges

Discovery Timeline

• 2026-02-06 - CVE CVE-2019-25305 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2019-25305

Vulnerability Analysis

The vulnerability exists due to improper quoting of the service executable path in the Windows service configuration for the jswpbapi service. When a Windows service path contains spaces and is not enclosed in quotation marks, Windows attempts to locate the executable by iteratively parsing the path at each space character. This behavior allows an attacker to plant a malicious executable at an intermediate path location that Windows will execute with the service's privileges.

The jswpbapi service runs under LocalSystem context, which is the highest privilege level on Windows systems. Successful exploitation grants the attacker complete control over the affected machine, including access to all local resources, the ability to install persistent backdoors, and potential lateral movement capabilities within a network.

Root Cause

The root cause is the failure to properly quote the service executable path during installation. When the JumpStart application is installed, the service registration does not wrap the path in quotation marks, even though the installation directory contains spaces (commonly C:\Program Files\... or similar). Windows CreateProcess API behavior then allows path injection attacks due to its left-to-right path parsing mechanism.

Attack Vector

Exploitation requires local access to the target system. The attacker must have write permissions to one of the intermediate directories in the unquoted service path. Common attack scenarios involve placing a malicious executable named to match a partial path segment (such as Program.exe in C:\ if the service path begins with C:\Program Files\...).

When the service restarts—either manually triggered, after a system reboot, or through service crash manipulation—Windows will execute the attacker's payload with LocalSystem privileges instead of the legitimate service binary.

The attack flow typically follows these steps: First, the attacker identifies the unquoted service path using Windows service enumeration tools. Next, they determine which intermediate directory they have write access to. Then they place a malicious executable at that location with a filename matching the truncated path. Finally, the attacker triggers a service restart to execute their payload with elevated privileges.

Detection Methods for CVE-2019-25305

Indicators of Compromise

• Unexpected executables in root directories or intermediate paths (e.g., C:\Program.exe, C:\Program Files\JumpStart\jswpbapi.exe variants)
• Service crash events followed by unusual process execution
• New executables appearing in write-accessible directories along the service path
• Anomalous child processes spawned by jswpbapi service

Detection Strategies

• Query Windows service configurations using sc qc jswpbapi or PowerShell Get-WmiObject Win32_Service to identify unquoted paths
• Monitor file creation events in directories commonly exploited for unquoted service paths
• Implement application whitelisting to prevent unauthorized executable execution
• Use SIEM rules to alert on new executable files in system-level directories

Monitoring Recommendations

• Enable Windows Security Event logging for process creation (Event ID 4688) with command-line auditing
• Monitor for service state changes (Event IDs 7035, 7036) particularly for the jswpbapi service
• Deploy endpoint detection and response (EDR) solutions to track file system modifications in critical paths
• Establish baselines for legitimate service binaries and alert on deviations

How to Mitigate CVE-2019-25305

Immediate Actions Required

• Audit all installed services for unquoted path vulnerabilities using tools like wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\"
• Manually fix the service path by adding quotation marks using the Windows Registry Editor or sc config command
• Restrict write permissions on directories within the service path hierarchy
• Review and harden service account configurations to minimize privilege exposure

Patch Information

Organizations should contact Infor Programa (the JumpStart vendor) for an official fix or updated installer that properly quotes the service path. In the absence of a vendor patch, administrators can manually remediate the vulnerability by modifying the service registry entry. Additional technical details are available in the VulnCheck Advisory for Jumpstart and Exploit-DB #47549.

Workarounds

• Manually quote the service executable path in the Windows Registry at HKLM\SYSTEM\CurrentControlSet\Services\jswpbapi\ImagePath
• Remove write permissions for non-administrative users from all directories in the service path
• Consider disabling the jswpbapi service if not operationally required until a proper fix is available
• Implement application control policies to prevent execution of unauthorized binaries in the affected path locations

# Configuration example - Fix unquoted service path via registry
# Run as Administrator in Command Prompt

# View current service configuration
sc qc jswpbapi

# Fix by updating the ImagePath with quoted path (adjust path as needed)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\jswpbapi" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\JumpStart\jswpbapi.exe\"" /f

# Verify the fix
sc qc jswpbapi