Remediate unquoted service path vulnerability via compliance item.

To identify vulnerabilities locally on your system: 

Launch Elevated powershell > type the comand below

Below we see that we do have 1 item that is vulnerable. 



This is what the ACAS Scans are finding however it does not tell you where to correct this within the registry. To remediate this we will have to locate the object within the registry and add quotes to the path. I  believe there is a way to configure reporting to be more verbose to include the registry location but I am unfamiliar with the ACAS tool. 

ACAS SCAN BEFORE IT IS FIXED

ACAS SCAN AFTER IT IS FIXED

NOTE: there is no screenshot for finding this on ACAS scans as it is remediated

Automated Fix via Compliance Item

We will create a compliance Item to discovery systems with the vulnerability and then remediate it. 

Discovery Script 

$value = cmd /c  'wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """'

if ($value -like "* *")

   {

   1

   }

   else

   {

   0

   }

Remediation Script 

Option Explicit

Const HKLM = &H80000002

Dim objWMIService

Dim colServices, objService

Dim strComputer

dim quote: quote=chr(34)

Dim strPathName

Dim strCommand,strArgs,message

Dim bBatch: bBatch = False

dim wshShell:Set wshShell = WScript.CreateObject("WScript.Shell")

Dim i, iCount, objReg

Dim bDebug:bDebug = False

'If not CScript, re-run with cscript...

If (Not IsCScript()) Then                               

                For i  = WScript.Arguments.Count -1 to  0 Step -1

                                strArgs = WScript.Arguments(i) & Space(1) &  strArgs

                Next

                WshShell.Run "CScript.exe " & quote & WScript.ScriptFullName & quote & space(1) & strArgs, 1, true

    WScript.Quit                  '...and stop running as WScript

End If

If WScript.Arguments.Count = 1 Then

                bBatch = True

                strComputer = WScript.Arguments(0)

Else

                strComputer = wshShell.ExpandEnvironmentStrings("%COMPUTERNAME%")

               

End If

If strComputer = "" Then WScript.Quit

strComputer = UCase(strComputer)

WMICX()

Main()

If Not bDebug Then

                WScript.Echo iCount & " Unquoted Service Path(s) were fixed on " & strComputer

End If

''''''''''' Functions and Subs ''''''''''''''''''

Sub WMICX()

                'WMI connection

                On Error Resume Next

                Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer& "\root\cimv2")

                If Err.Number <> 0 Then

                                message = "Error reaching or connecting to " & strComputer

                                If not bBatch Then

                                                MsgBox message, vbcritical + vbinformation,"Failure"

                                Else

                                                WScript.Echo message

                                End If

                                WScript.Quit(100)

                End If

                On Error GoTo 0

End Sub

Sub  Main()

                On Error Resume Next

                Set objReg = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")

                Set colServices = objWMIService.ExecQuery ("SELECT pathname,displayname FROM Win32_Service")

               

                iCount = 0

                For Each objService in colServices

                                strCommand = ""

                                strArgs = ""

                                strPathName = objService.PathName

                                'Parse the Pathname, which is the command

                                'This is a little complicated.

                                Dim iLastSlash, iProgEnd

                                'find the last \ character

                                iLastSlash = InStrRev(strPathName,"\")

                                'look for a space beginning at last \, put location in iProgEnd

                                iProgEnd = InStr(iLastSlash,strPathName,Space(1))

                               

                                'iProgEnd will be zero if no arguments

                                If iProgEnd > 1 Then

                                                strArgs= trim(Mid(strPathName,iProgEnd))

                                Else

                                                strCommand = strPathName

                                End        If

                               

                                If Left(strPathName,1) <> quote And InStr(strCommand,Space(1)) Then

                                                wscript.echo "Found " & objService.DisplayName & " Service with command line:" & _

                                                               VbCrLf & vbtab & objService.PathName

                                                FixService objService.Name, strCommand, strArgs

                                End If

                Next

End Sub

Sub FixService (strSvsName, strCommand,strArgs)

                If bDebug Then Exit Sub

                'add a space only if there are arguments

                If Len(strArgs) > 0 Then strArgs = strArgs & Space(1) & strArgs

                Dim strValue

                Dim strRegPath,strImagePath

                strRegPath= "SYSTEM\CurrentControlSet\Services\"& strSvsName

                strImagePath = quote  & strCommand & quote & strArgs

                WScript.Echo "Setting Command line to " & strImagePath

                objReg.SetExpandedStringValue HKLM,strRegPath,"ImagePath",strImagePath

                iCount = iCount +1

End Sub

Function IsCScript()

    If (InStr(UCase(WScript.FullName), "CSCRIPT") <> 0) Then

        IsCScript = True

    Else

        IsCScript = False

    End If

End Function

 
  
At this point go ahead and deploy the configuration item you have just created. I would recommend only performing this against workstations but only after serious testing. 

Unfortunately I forgot to take a screenshot when I fist deployed this compliance item, but I do have one after half the systems checked for policy.

 After systems get policy we are now looking at a very high remediation percentage.

NOTE: this will run on its own automatically but you can individually set this to run. This will be by launching the configmr client > Configurations Tab > Select the compliance item > Evaluate

This is what a successful report looks like for the configuration item. 

The compliance item can be downloaded on Technet here.

I would like to thank Khalid Al Alul, and Ricky Richard for their time in working on this configuration item.