CVE-2022-50901: Wondershare Dr.Fone Privilege Escalation

CVE-2022-50901 Overview

CVE-2022-50901 is an unquoted service path vulnerability affecting Wondershare Dr.Fone version 11.4.9. The vulnerability exists in the DFWSIDService component, where the service executable path is not properly quoted. This allows local users with limited privileges to potentially execute arbitrary code with elevated LocalSystem privileges by placing a malicious executable in a strategic location along the service path.

Critical Impact

Local privilege escalation to LocalSystem through unquoted service path exploitation in DFWSIDService, enabling complete system compromise.

Affected Products

• Wondershare Dr.Fone 11.4.9
• DFWSIDService component

Discovery Timeline

• 2026-01-13 - CVE CVE-2022-50901 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50901

Vulnerability Analysis

This vulnerability is classified under CWE-428 (Unquoted Search Path or Element). When the Windows Service Control Manager attempts to start the DFWSIDService, it parses the unquoted service path C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\. Due to the spaces in the directory names and the lack of quotation marks around the path, Windows attempts to locate executables at each space boundary before finding the intended service binary.

The exploitation requires local access to the system with the ability to write files to specific directories. An attacker can take advantage of the path parsing behavior by placing a malicious executable at locations such as C:\Program.exe or C:\Program Files (x86)\Wondershare\Wondershare.exe. When the service restarts (either through system reboot or manual service restart), the malicious executable will be executed with LocalSystem privileges instead of the legitimate service binary.

Root Cause

The root cause of this vulnerability is improper configuration of the Windows service path during installation. The DFWSIDService was registered without enclosing the full executable path in quotation marks. When service paths contain spaces and are not quoted, Windows' CreateProcess API attempts to find executables by tokenizing the path at each space character, creating multiple potential execution points that can be exploited.

Attack Vector

This is a local attack vector requiring the attacker to have prior access to the target system with write permissions to directories along the unquoted path. The attack flow involves identifying the vulnerable service path, creating a malicious payload executable, placing it in one of the potential execution locations, and triggering a service restart. Upon service restart, the malicious code executes with LocalSystem privileges, granting the attacker complete control over the affected system.

Technical details and proof-of-concept information are available at Exploit-DB #50755.

Detection Methods for CVE-2022-50901

Indicators of Compromise

• Unexpected executable files present at C:\Program.exe or similar truncated path locations
• Suspicious executables named Wondershare.exe in the C:\Program Files (x86)\Wondershare\ directory
• Unusual processes spawned by the DFWSIDService or running with LocalSystem privileges
• Modification timestamps on service-related directories that don't align with legitimate software updates

Detection Strategies

• Query Windows services for unquoted paths using wmic service get name,displayname,pathname,startmode | findstr /i /v """ and check for DFWSIDService entries
• Monitor for file creation events in parent directories of the Wondershare installation path
• Implement application whitelisting to prevent unauthorized executables from running in sensitive directories
• Use endpoint detection tools to alert on new executable files in system directories

Monitoring Recommendations

• Enable Windows Security Event logging for service start/stop events (Event IDs 7035, 7036)
• Configure file integrity monitoring on directories susceptible to unquoted path exploitation
• Monitor process creation events for unexpected parent-child relationships involving system services
• Alert on any new executables created in C:\Program Files (x86)\Wondershare\ outside of official update processes

How to Mitigate CVE-2022-50901

Immediate Actions Required

• Verify the DFWSIDService path configuration using the Windows Services management console or registry
• Restrict write permissions on parent directories along the unquoted service path
• Consider temporarily disabling the DFWSIDService if not critical to operations until a patch is applied
• Audit the system for any suspicious executables that may have been placed in exploitation locations

Patch Information

Users should check the Wondershare Official Site for updated versions of Dr.Fone that address this vulnerability. The VulnCheck Security Advisory provides additional guidance on remediation steps.

Workarounds

• Manually quote the service path in the Windows Registry by navigating to HKLM\SYSTEM\CurrentControlSet\Services\DFWSIDService and enclosing the ImagePath value in quotation marks
• Implement strict access controls to prevent non-administrative users from writing to directories in the service path
• Use Windows Software Restriction Policies or AppLocker to block execution of unauthorized executables in affected directories
• Consider uninstalling Wondershare Dr.Fone if not actively needed until an official patch is available

# Registry fix to quote the service path (run as Administrator)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\DFWSIDService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone\DFWSIDService.exe\"" /f