How to Fix the Unquoted Service Path Vulnerability Using Windows Registry

The Unquoted Service Path vulnerability is one of the most common findings in Windows security audits and vulnerability scans (such as Nessus or Qualys). While it is often classified as a medium-risk issue, an attacker with local, non-admin permissions can leverage it for local privilege escalation (LPE) to gain full system access.

In this guide, we’ll walk through what causes this issue and how to fix it manually using the Windows Registry Editor (regedit).

What is an Unquoted Service Path Vulnerability?

When a Windows service is created, its executable path is defined in the system. If that path contains spaces—such as C:\Program Files\My Service\service.exe—and is not enclosed in double quotes, Windows interprets the path ambiguously.

When starting the service, Windows attempts to execute files by guessing where the executable path ends at every space:

1. C:\Program.exe
2. C:\Program Files\My.exe
3. C:\Program Files\My Service\service.exe

If an attacker has write permissions to C:\ or C:\Program Files\, they can drop a malicious executable named Program.exe or My.exe. Windows will execute the attacker’s binary under the elevated context of the target service (often NT AUTHORITY\SYSTEM).

Prerequisites

• Administrative Privileges: You must run the Registry Editor as an Administrator.
• Backup: Always create a system restore point or back up the Registry before making manual modifications.

1.Identify the Vulnerable Service

With your vulnerability scan report in hand, establish your list of systems and services that are vulnerable.

2.Open the Windows Registry Editor:Requires elevated permissions.

1. Press Win + R to open the Run dialog.
2. Type regedit and press Enter.
3. Select Yes when prompted by User Account Control (UAC).

3.Navigate to the Services Key:

In the Registry Editor, paste the following path into the address bar at the top and press Enter:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

This folder contains a subkey for every registered service on your Windows machine.

4.Locate and Modify the Path Value:

1. Scroll down the list of services to locate the vulnerable service folder (matching the Name identified in Step 1).
2. Click on the service key to open its contents in the right-hand panel.
3. Double-click the string value named ImagePath.
4. Enclose the entire file path in double quotes, leaving any command-line parameters outside the quotes if applicable.

Before:

C:\Program Files\Vendor App\bin\appservice.exe -run

After:

"C:\Program Files\Vendor App\bin\appservice.exe" -run

5. Click OK to save the changes.

5.Restart the Service and Verify:Apply changes immediately.

To apply the changes, restart the affected service:

DOS

net stop "ServiceName"
net start "ServiceName"

Best Practices & Automation

While manual remediation in regedit works great for individual machines, fixing this across an enterprise fleet is best done using PowerShell scripts or Group Policy Objects (GPO). Always inform software vendors if their installers create unquoted service paths by default so they can patch their deployment packages.