CVE-2021-47863: MacPaw Encrypto Privilege Escalation Flaw

CVE-2021-47863 Overview

CVE-2021-47863 is an unquoted service path vulnerability affecting MacPaw Encrypto 1.0.1 on Windows systems. The vulnerability exists in the Encrypto Service configuration, where the service executable path contains spaces but is not properly enclosed in quotation marks. This flaw allows local attackers with write access to specific directories to plant malicious executables and potentially achieve privilege escalation when the vulnerable service starts or restarts.

Critical Impact

Local attackers can exploit the unquoted service path to execute arbitrary code with elevated privileges, potentially gaining full system control on affected Windows machines running MacPaw Encrypto 1.0.1.

Affected Products

• MacPaw Encrypto 1.0.1 for Windows
• Systems with Encrypto Service installed in C:\Program Files\Encrypto\

Discovery Timeline

• 2026-01-21 - CVE-2021-47863 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47863

Vulnerability Analysis

This vulnerability falls under CWE-428 (Unquoted Search Path or Element), a common Windows service misconfiguration issue. When a Windows service is configured with an executable path containing spaces that isn't properly quoted, the Windows Service Control Manager (SCM) attempts to resolve the path ambiguously. For the path C:\Program Files\Encrypto\EncryptoService.exe, Windows will sequentially attempt to execute C:\Program.exe, then C:\Program Files\Encrypto\EncryptoService.exe.

The local attack vector requires the attacker to have authenticated access to the system with write permissions to a directory in the unquoted path. The exploitation does not require user interaction once the malicious executable is placed, as the service execution will trigger the payload during system boot or service restart events.

Root Cause

The root cause is improper handling of the service binary path during the Encrypto Service installation on Windows. The installer fails to wrap the service executable path in quotation marks when registering the service in the Windows registry. Specifically, the ImagePath value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EncryptoService contains an unquoted path with spaces, enabling the path injection attack.

Attack Vector

The attack requires local access and involves placing a malicious executable named Program.exe in the C:\ root directory (if writable) or exploiting other path segments. When the Encrypto Service starts—either during system boot, manual start, or restart after a crash—Windows SCM parses the unquoted path and may execute the attacker-controlled binary with the privileges of the service account (often SYSTEM).

The exploitation chain involves:

1. Identifying the unquoted service path in the Encrypto Service configuration
2. Creating a malicious payload executable
3. Placing the payload in a location that will be resolved before the legitimate service binary
4. Waiting for or triggering a service restart to execute the payload with elevated privileges

For technical exploitation details, refer to the Exploit-DB #49694 advisory.

Detection Methods for CVE-2021-47863

Indicators of Compromise

• Unexpected executables named Program.exe or similar in the C:\ root directory
• Suspicious binaries in directories along the C:\Program Files\ path hierarchy
• Anomalous process execution chains where Program.exe spawns from service context
• Registry modifications to the Encrypto Service ImagePath value

Detection Strategies

• Query Windows services for unquoted paths containing spaces using tools like wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
• Monitor for file creation events in C:\ and C:\Program Files\ directories for unexpected executables
• Implement EDR rules to detect service-spawned processes from non-standard paths
• Audit service configurations regularly using PowerShell or security scanning tools

Monitoring Recommendations

• Enable Windows Security Event logging for service control operations (Event ID 7045 for new service installations)
• Configure file integrity monitoring on critical system directories
• Deploy behavioral detection for privilege escalation patterns via service exploitation
• Alert on any process execution from the root C:\ directory with SYSTEM privileges

How to Mitigate CVE-2021-47863

Immediate Actions Required

• Audit all installed services for unquoted path vulnerabilities using system enumeration tools
• Restrict write permissions to C:\ root directory and C:\Program Files\ to administrators only
• Consider uninstalling MacPaw Encrypto 1.0.1 until a patched version is available
• Implement application whitelisting to prevent unauthorized executable execution

Patch Information

No official patch information is currently available from MacPaw for this vulnerability. Organizations should monitor the MacPaw Encrypto product page for security updates. Additionally, review the VulnCheck Advisory for Encrypto for the latest remediation guidance.

Workarounds

• Manually fix the unquoted service path by modifying the registry ImagePath value to include quotation marks around the full executable path
• Implement strict ACLs on directories that could be exploited in the path resolution
• Deploy endpoint protection with behavioral analysis to detect and block exploitation attempts
• Use Windows Defender Application Control or AppLocker to restrict execution to known-good binaries

# Manual registry fix to quote the service path (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\EncryptoService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Encrypto\EncryptoService.exe\"" /f