CVE-2021-47773: Dynojet Power Core Privilege Escalation

CVE-2021-47773 Overview

CVE-2021-47773 is an unquoted service path vulnerability affecting Dynojet Power Core 2.3.0. The vulnerability exists in the DJ.UpdateService Windows service, which contains an unquoted binary path that allows local authenticated users to potentially execute arbitrary code with elevated privileges. By placing a malicious executable in the service's file path, attackers can hijack the service execution flow and gain Local System access.

Critical Impact

Local authenticated attackers can escalate privileges to SYSTEM level by exploiting the unquoted service path in DJ.UpdateService, potentially leading to complete system compromise.

Affected Products

• Dynojet Power Core 2.3.0
• DJ.UpdateService component
• Windows-based Dynojet installations

Discovery Timeline

• 2026-01-15 - CVE CVE-2021-47773 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2021-47773

Vulnerability Analysis

This vulnerability is classified under CWE-428 (Unquoted Search Path or Element). When a Windows service is configured with a path containing spaces and the path is not enclosed in quotes, Windows will attempt to locate the executable by parsing the path at each space character. This behavior can be exploited by an attacker who places a malicious executable at one of the parsed path locations.

In the case of Dynojet Power Core's DJ.UpdateService, the service binary path is not properly quoted. When the service starts, Windows may execute an attacker-controlled binary placed earlier in the path resolution chain instead of the legitimate service executable. Since Windows services typically run with elevated privileges, successful exploitation grants the attacker Local System access.

Root Cause

The root cause of this vulnerability is improper service configuration during the Dynojet Power Core installation process. The service path for DJ.UpdateService was registered in the Windows Service Control Manager without enclosing quotes, despite containing directory names with spaces. This configuration error allows Windows path parsing behavior to be abused for privilege escalation.

Attack Vector

The attack requires local access with standard user privileges. An attacker must identify the unquoted service path and determine which directories in the path are writable. Once a writable location is found earlier in the path resolution chain, the attacker places a malicious executable with a specific filename that matches the path parsing pattern. When the vulnerable service is restarted (either manually or through system reboot), the malicious executable is run with SYSTEM privileges instead of the legitimate service binary.

The local attack vector requires the attacker to have interactive access to the system. While the technical complexity of the exploit is relatively low, successful exploitation depends on write permissions to specific file system locations along the service path.

Detection Methods for CVE-2021-47773

Indicators of Compromise

• Unexpected executable files in root directories or early path locations (e.g., C:\Program.exe, C:\Dynojet.exe)
• Unusual service startup failures for DJ.UpdateService followed by suspicious process activity
• New executable files created in directories along the Dynojet Power Core installation path
• Process execution with SYSTEM privileges originating from non-standard locations

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject win32_service | Where-Object {$_.PathName -match '^[^"].*\s.*[^"]$'}
• Monitor file creation events in root directories and common installation paths using file integrity monitoring solutions
• Implement endpoint detection rules for process execution patterns indicative of unquoted service path exploitation
• Review Windows Security Event logs for service-related events (Event IDs 7045, 7036) with suspicious executable paths

Monitoring Recommendations

• Enable enhanced auditing for file system changes in C:\Program Files and related directories
• Configure SentinelOne to monitor for unauthorized binary placement in service path directories
• Establish baseline service configurations and alert on deviations in service binary paths
• Monitor for privilege escalation attempts from standard user accounts to SYSTEM

How to Mitigate CVE-2021-47773

Immediate Actions Required

• Audit the DJ.UpdateService configuration and verify the binary path is properly quoted
• Restrict write permissions on directories along the service path to administrators only
• Update Dynojet Power Core to the latest version if a patched version is available from the Dynojet Official Website
• Implement application whitelisting to prevent execution of unauthorized binaries

Patch Information

Users should check with Dynojet for updated software versions that address this vulnerability. Additional technical details about this vulnerability are available in Exploit-DB #50466.

In the absence of an official patch, administrators should manually remediate the unquoted service path by modifying the service configuration in the Windows registry or using the sc command to reconfigure the service with a properly quoted path.

Workarounds

• Manually fix the unquoted service path using the Windows Registry Editor or sc config command to add quotes around the binary path
• Restrict NTFS permissions on writable directories in the service path to prevent non-privileged users from creating files
• Implement Software Restriction Policies or AppLocker rules to block execution of binaries from non-standard locations
• Disable the DJ.UpdateService if it is not required for operational functionality

# Configuration example - Fix unquoted service path
sc config "DJ.UpdateService" binPath= "\"C:\Program Files\Dynojet\Power Core\DJ.UpdateService.exe\""

# Verify the service path is now quoted
sc qc "DJ.UpdateService"