CVE-2025-14018

CVE-2025-14018: NetBT e-Fatura Privilege Escalation Vulnerability

📋 General Information

🔍 Vulnerability Description

This vulnerability allows an unauthorized local user to execute arbitrary code with elevated privileges on the system. The InboxProcessor service of NetBT e-Fatura is configured with an Unquoted Service Path, enabling an attacker with basic permissions to escalate privileges to LocalSystem.

Identified Attack Vectors

1. Unquoted Service Path

   • Current path: C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
   • Without quotes, the system attempts to execute: C:\inetpub\wwwroot\InboxProcessor.exe
   • An attacker can place a malicious executable in that intermediate path

2. Excessive Permissions

   • The BUILTIN\Users group has read and write (RW) permissions
   • Standard users can modify files in the service directory

3. Execution with Maximum Privileges

   • The service runs as LocalSystem
   • Full system control if escalation is achieved

📊 Proof of Concept (PoC)

Detected Vulnerable Configuration

C:\Users\efatura>sc qc InboxProcessor
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: InboxProcessor
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : InboxProcessor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Permission Analysis

C:\Users\efatura\Desktop>accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\inetpub\wwwroot\InboxProcessor
  RW BUILTIN\Users                    ⚠️ CRÍTICO
  RW NT SERVICE\TrustedInstaller
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators

🛠️ Solution and Mitigation

Prerequisites

• Administrator privilege access
• PowerShell terminal run as Administrator

Step 1: Quote the Service Path

Execute the following command to add quotes to the executable path:

sc.exe config InboxProcessor binPath= "`"C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe`""

⚠️ Note: The space after binPath= is mandatory.

Step 2: Restrict Folder Permissions

Remove excessive permissions from the standard user group:

# Definir la ruta de la carpeta
$path = "C:\inetpub\wwwroot\InboxProcessor"

# Eliminar todos los permisos para el grupo de Usuarios comunes
icacls $path /remove "BUILTIN\Users" /t /c /l

# Asegurar que los Administradores y el Sistema mantengan el control total
icacls $path /grant "Administrators:(OI)(CI)F" /t
icacls $path /grant "SYSTEM:(OI)(CI)F" /t

Parameter explanation:

• /t : Applies changes recursively
• /c : Continues even if errors occur
• /l : Works on the symbolic link instead of the target
• (OI)(CI)F : Permission inheritance with full control

Step 3: Final Verification

Confirm that the changes were applied correctly:

# Verificar que la ruta ahora está entrecomillada
sc qc InboxProcessor

# Verificar que BUILTIN\Users ya no tiene permisos RW
accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"

Expected result:

• BINARY_PATH_NAME should appear in quotes
• BUILTIN\Users should not appear in the permission list

📦 Software Update

It is recommended to update NetBT e-Fatura to version 1.2.15 or higher, which includes native fixes for this vulnerability.

Update Steps

1. Download the latest version from: https://net-bt.com.tr/e-fatura/
2. Back up the current configuration
3. Run the update installer
4. Restart the InboxProcessor service

📚 References

• CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14018
• CWE-428: Unquoted Search Path or Element
• Vendor: NetBT Consulting Services Inc.
• Credits: Seccops, Levent Sungu

✅ Security Checklist

• Quote the service path
• Remove RW permissions from BUILTIN\Users
• Verify that only Administrators and SYSTEM have access
• Update NetBT e-Fatura to v1.2.15+
• Restart the InboxProcessor service
• Run post-patch security audit
• Document changes in the change log

⚠️ Security Warning

This vulnerability allows arbitrary code execution with LocalSystem privileges. It is considered a critical risk in production environments. Apply patches immediately.

Last updated: 22/12/2025