DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63KHMoS1070552
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 103BE4AA6FFF
MIME-Version: 1.0
References: <SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2 AT SJ1PR10MB6003 DOT namprd10 DOT prod DOT outlook DOT com>
In-Reply-To: <SJ1PR10MB6003B9ADBEC8F87C9AC49AC3F82F2@SJ1PR10MB6003.namprd10.prod.outlook.com>
Date: Mon, 20 Apr 2026 11:21:35 -0600
Message-ID: <CANV9t=TEQVuhe72zoHB9Q2Cqrd8VihRPWqnRD8B6ZnhJVpUPpg@mail.gmail.com>
Subject: Re: cygrunsrv CWE-428
To: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
From: William Stewart via Cygwin <cygwin AT cygwin DOT com>
Reply-To: bstewart AT iname DOT com
Cc: William Stewart <abqbill AT gmail DOT com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On Mon, Apr 20, 2026 at 9:43 AM James Warnock wrote:

We use cygwin including installing some services via cygrunsrv. We have had
> some users run vulnerability scans which flag the installed services due to
> an unquoted service path (CWE-428 [1]). I haven't been able to find any
> discussion of this in the archives except for the "cygrunsrv -L outputs
> nothing if service paths are quoted" [2]. In that message, another user
> manually added quotes to resolve the vulnerability scan but then 'cygrunsrv
> -L' no longer listed installed services. That issue was fixed.
>
> I did come up with a simple patch (attached) that worked for my limited
> use case. But there may be considerations for global usage of which I am
> unaware.
>
> Should cygrunsrv be updated to automatically include the quotes?


Probably a good idea for a future update, if only to silence these dubious
"vulnerabilities" that get flagged by these scanners.

In the meantime, for those who might find it useful, I wrote a JScript
script that you can run as a GPO startup script that corrects this
"vulnerability" for all services on a machine (including services run by
cygrunsrv):

https://gist.github.com/Bill-Stewart/9379a8df293de418ed96ee6ea82c4459

Bill

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple