VNX-428: Unquoted Search Path or Element

Reports C, C++ and C# code that hands an unquoted Windows executable path containing a space to CreateProcess (NULL application name), WinExec, CreateService, a service ImagePath value or sc.exe binPath=, so Windows first runs C:\Program.exe or another space-truncated prefix.

Field	Value
Rule ID	`VNX-428`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, C#
CWE	CWE-428
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`unquoted-path` `windows` `cwe-428`
Source	`internal/sast/rules/vnx-428.rego`

Overview

VNX-428 maps to CWE-428: Unquoted Search Path or Element. When a path such as C:\Program Files\Acme Agent\agent.exe is passed unquoted to an API that splits the command line at spaces, Windows tries C:\Program.exe, then C:\Program Files\Acme.exe, before the intended program. A local user who can write one of those locations gets code execution, often as a service account.

What Gets Flagged

CreateProcess/CreateProcessA/CreateProcessW with a NULL application name and such a literal command line, or a buffer that received one up to twenty lines above.
WinExec with such a literal or buffer.
CreateService whose arguments include such a literal (the service binary path).
A service ImagePath registry value (SetValue, Registry.SetValue, RegSetValueEx) set to such a literal.
An sc.exe binPath= whose path is quoted only for the outer process.

CreateProcessW(NULL, L"C:\\Program Files\\Acme Agent\\agent.exe --run", ...);   // FLAGGED
WinExec("C:\\Program Files\\Acme\\update.exe /silent", SW_HIDE);                  // FLAGGED

CreateProcessW(NULL, L"\"C:\\Program Files\\Acme Agent\\agent.exe\" --run", ...); // not flagged

Not reported: a path wrapped in its own quotes, CreateProcess with lpApplicationName set, paths without a space, ShellExecute and .NET Process.Start, paths built at run time, comments.

Remediation

Quote the executable path inside the command line ("\"C:\\Program Files\\...\\agent.exe\" args").
Pass the executable separately as lpApplicationName.
Register service binary paths in quotes.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-428
// nosec vnx-428

Or record an ignore rule: vulnetix ignore add --rule vnx-428 --reason "...". See Suppressing findings.