CVE-2021-47889: Softros LAN Messenger Privilege Escalation

CVE-2021-47889 Overview

CVE-2021-47889 is an unquoted service path vulnerability in Softros LAN Messenger 9.6.4. The flaw affects the SoftrosSpellChecker Windows service, which registers an executable path containing spaces without surrounding quotation marks. Local attackers with limited privileges can place a malicious executable along the unquoted path to hijack service execution. When the service starts, Windows may execute the attacker-supplied binary in the security context of the service account, enabling privilege escalation on the host. The issue is tracked under CWE-428: Unquoted Search Path or Element.

Critical Impact
Local attackers can escalate privileges by planting a malicious executable in the unquoted SoftrosSpellChecker service path, gaining code execution under the service account.

Affected Products

Softros LAN Messenger 9.6.4
SoftrosSpellChecker Windows service component
Installations using the default path C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\

Discovery Timeline

2026-01-23 - CVE-2021-47889 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2021-47889

Vulnerability Analysis

The vulnerability arises because the SoftrosSpellChecker service registers its ImagePath value in the Windows registry without enclosing the full path in quotation marks. The installation directory C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\ contains multiple spaces. When the Windows Service Control Manager (SCM) parses an unquoted path with spaces, it attempts to execute each whitespace-delimited prefix as a candidate binary.

An attacker who can write to any intermediate directory in the path, such as C:\Program Files (x86)\Softros Systems\, can drop a malicious file named Softros.exe or Softros Messenger.exe. On the next service start or system reboot, SCM may invoke the planted binary instead of the legitimate spell checker executable. The injected process inherits the service account context, which typically runs as LocalSystem.

Root Cause

The root cause is improper handling of file system paths in the service installer. The installer fails to wrap the ImagePath value in quotation marks, leaving the registry entry vulnerable to whitespace-based binary substitution. This is a classic instance of CWE-428 and reflects a missing input sanitization control during service registration.

Attack Vector

Exploitation requires local access and write permissions to one of the parent directories in the unquoted path. Standard users on misconfigured systems may have write access to directories under C:\Program Files (x86)\ due to permissive ACLs or installation choices. The attacker stages a payload, waits for service restart or reboot, and obtains code execution as LocalSystem. Technical details and a proof-of-concept are published in Exploit-DB entry 49588 and the VulnCheck advisory on Softros LAN Messenger.

No verified exploitation code is reproduced here. See the referenced advisories for full technical analysis.

Detection Methods for CVE-2021-47889

Indicators of Compromise

Unexpected executables such as Softros.exe or Program.exe present in C:\ or C:\Program Files (x86)\Softros Systems\
Service start events (Event ID 7036) for SoftrosSpellChecker followed by process creation from non-standard paths
Child processes spawned by services.exe running outside the documented installation directory
Modifications to ACLs on parent directories of the service install path

Detection Strategies

Audit the Windows registry value HKLM\SYSTEM\CurrentControlSet\Services\SoftrosSpellChecker\ImagePath for missing quotation marks around the service binary path
Enumerate all services with wmic service get name,pathname,startmode and filter for unquoted paths containing spaces
Monitor process creation events (Sysmon Event ID 1) for binaries launched by services.exe from directories other than the expected Spell Checker\ subfolder
Run periodic configuration scans that flag writable ACLs on directories under C:\Program Files (x86)\

Monitoring Recommendations

Enable Windows Security event auditing for service installation, modification, and start events
Forward Sysmon process creation and file creation events to a centralized SIEM for correlation
Alert on file write activity in service path parent directories by non-administrative accounts
Track privilege escalation indicators such as LocalSystem processes launched from user-writable locations

How to Mitigate CVE-2021-47889

Immediate Actions Required

Inventory all hosts running Softros LAN Messenger 9.6.4 and identify the SoftrosSpellChecker service
Remove write permissions for non-administrative users on every directory along the unquoted service path
Manually quote the ImagePath registry value for the affected service until a vendor fix is applied
Restrict local logon rights on systems where the messenger is installed to reduce the local attacker surface

Patch Information

No vendor patch is referenced in the available CVE data. Administrators should consult Softros for an updated release that quotes the service path. Until a patched version is available, apply the registry and ACL workarounds described below.

Workarounds

Edit the registry value HKLM\SYSTEM\CurrentControlSet\Services\SoftrosSpellChecker\ImagePath to wrap the full executable path in double quotes
Tighten directory ACLs so only Administrators and SYSTEM can create files in C:\Program Files (x86)\Softros Systems\ and its parent
Uninstall Softros LAN Messenger from systems where it is not required
Apply application allowlisting to prevent execution of unauthorized binaries from program file directories

bash

# Configuration example: query and correct the unquoted service path
sc qc SoftrosSpellChecker

# After confirming the unquoted path, update ImagePath with quotes (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\SoftrosSpellChecker" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\Softros Systems\Softros Messenger\Spell Checker\SoftrosSpellChecker.exe\"" /f

# Restart the service to apply
sc stop SoftrosSpellChecker
sc start SoftrosSpellChecker