Overview

An insecure service configuration was identified in Sunshine for Windows. The Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. The condition corresponds to CWE-428: Unquoted Search Path or Element and allows a local attacker with write access to the chosen directory prefix (for example C:\Program\) to execute arbitrary code with NT AUTHORITY\SYSTEM privileges when the service starts.

Vulnerability Details

Technical Description

During installation, the Sunshine setup registers a Windows service named SunshineService. The BINARY_PATH_NAME for this service, which points to sunshinesvc.exe, is stored in the Windows Registry without being enclosed in quotation marks.

When the Service Control Manager attempts to start a service with an unquoted path containing spaces, it interprets the path token by token. For example, with a path like C:\Program\Game Stream\Sunshine\tools\sunshinesvc.exe, the SCM first probes C:\Program\Game.exe before C:\Program\Game Stream\Sunshine\tools\sunshinesvc.exe.

If a low-privilege user can create C:\Program\Game.exe, when the SunshineService is started, the Service Control Manager will execute the attacker's file with the privileges of the service, which is NT AUTHORITY\SYSTEM.

While the default installation path (C:\Program Files\Sunshine) is generally safe because standard users cannot write to the root of C:\ directory (thus, they cannot create a rogue Program.exe at that location), this vulnerability becomes exploitable if Sunshine is installed into a custom location with spaces in its path such as C:\Program\Game Stream\Sunshine, located within a directory that a regular user have write permissions for.

Proof of Concept (PoC)

The following steps demonstrate the vulnerability by installing Sunshine to C:\Program\Game Stream\Sunshine.

Step 1: Installation in a Vulnerable Path
During setup, a custom installation path of C:\Program\Game Stream\Sunshine is chosen.

Step 2: Confirming the Unquoted Service Path
After installation, Process Monitor shows that the installer writes the unquoted path to the registry for the SunshineService.

Running the command sc.exe qc SunshineService in a command prompt confirms that the BINARY_PATH_NAME is indeed unquoted.

Step 3: Observing the Vulnerable Behavior
When the SunshineService is started, we can observe the path-parsing logic in action. Process Monitor captures services.exe attempting to find and execute C:\Program\Game.exe, which results in a NAME NOT FOUND error. This occurs before it correctly locates the legitimate sunshinesvc.exe, confirming the vulnerable logic.

Step 4: Placing the Malicious Executable
A malicious executable is created, named Game.exe, and placed in the C:\Program\ directory.

Step 5: Exploitation
Launch Sunshine, or restart the SunshineService. As the service starts up, the operating system's parser again follows the logic from Step 3. This time, it finds the malicious C:\Program\Game.exe and executes it with LocalSystem privileges.
Process Monitor confirms that services.exe successfully launches C:\Program\Game.exe.

Impact

Successful exploitation of this vulnerability allows a local, low-privileged user who can write to directory path segment that precedes the first space in the unquoted string to execute arbitrary code as SYSTEM permissions. This leads to a privilege escalation, granting the attacker control over the compromised system. An attacker could use this to install persistent malware, steal sensitive data, or disable security controls.

It is recommended to enclose the BINARY_PATH_NAME for the SunshineService in quotation marks during installation to remediate this vulnerability.

Note: The default installation path (C:\Program Files\Sunshine) is rarely exploitable, because standard users cannot write to the root of C: on modern Windows. The risk materialises when:

• An administrator selects a different installation folder that contains a space (e.g. C:\\Program\\Game Stream\\Sunshine), or
• Sunshine is installed to a secondary drive or share with weaker ACLs, or
• The system root’s ACLs are relaxed.