ProtonVPN v4.4.1 - Unquoted Service Path
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact describes an unquoted service path vulnerability in ProtonVPN v4.4.1 and provides a PowerShell command to query the service configuration, which only detects the vulnerability without exploiting it.
Backdoor review
No backdoor observed in reviewed code
The supplied text is a straightforward public disclosure of an unquoted service path vulnerability in ProtonVPN 4.4.1. It contains a description of the vulnerability, a proof-of-concept showing the service configuration, and no hidden commands, obfuscated payloads, or deceptive instructions. No backdoor or trojan behavior is present.
Classification basis and observed behavior
Classification basis
The artifact provides a PowerShell command (sc.exe qc) that only queries and displays the service configuration, which is a detection technique, not an exploitation. It does not include code to insert or execute a malicious payload.
exploits/windows/local/52624.txt:20Requirements
- Local access to a Windows system with ProtonVPN v4.4.1 installed
exploits/windows/local/52624.txt:1
Observed behavior
- Queries the configuration of the 'ProtonVPN WireGuard' service using sc.exe to display its binary path, revealing an unquoted service path vulnerability.
exploits/windows/local/52624.txt:20-29
Behaviors behind the backdoor verdict
Observables
- Vulnerability Disclosure
- Unquoted service path for 'ProtonVPN Wireguard' serviceThe PoC demonstrates that the service binary path contains spaces and is not quoted, which is a known local privilege escalation technique if an attacker can place a malicious executable in the path.
exploits/windows/local/52624.txt:27-29
What the analysis did not establish
- The artifact is a single text file with no executable code; it only contains a description and a service query command.
- Review is limited to the supplied text file; no external tools, libraries, or referenced resources were analyzed.
- The artifact is a text file describing a vulnerability; no executable code is present to analyze for hidden behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.