High Severity Unquoted Search Path Vulnerability Plagues MuseHub (CVE-2025-13433)

Overview

A critical security vulnerability, identified as CVE-2025-13433, has been discovered in Muse Group’s MuseHub version 2.1.0.1567. This flaw stems from an unquoted search path issue within the Windows Service component of the application. The vulnerability allows a local attacker to potentially escalate privileges by placing a malicious executable in a directory that is searched before the intended application directory. The vendor, Muse Group, was notified but has not responded to the disclosure.

Technical Details

The vulnerability resides in an unknown function of the C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe file, which is part of the MuseHub Windows Service. The root cause is an unquoted search path, meaning that the operating system may search for executables in unexpected locations if a path component contains spaces and is not properly enclosed in quotes. This allows an attacker with local access to potentially execute arbitrary code with elevated privileges.

The attack requires local access and is considered difficult to exploit due to the need to insert a malicious executable into a directory that is searched before the correct application directory by the service. However, the potential impact is significant.

CVSS Analysis

The vulnerability has been assigned a CVSS score of 7.0, classifying it as HIGH severity.

• CVSS Score: 7.0
• Attack Vector: Local (L)
• Attack Complexity: High (H)
• Privileges Required: Low (L)
• User Interaction: None (N)
• Scope: Unchanged (U)
• Confidentiality Impact: High (H)
• Integrity Impact: High (H)
• Availability Impact: High (H)

Possible Impact

Successful exploitation of this vulnerability could allow a local attacker to:

• Escalate privileges on the system.
• Execute arbitrary code with the privileges of the MuseHub service.
• Potentially compromise the entire system.

Mitigation or Patch Steps

Currently, there is no official patch available from Muse Group. Given the vendor’s lack of response, users are advised to implement the following workaround:

1. Manually add quotes around the executable path in the Windows Service configuration. This will ensure that the operating system searches only the intended directory. To do this:
   • Open the Registry Editor (regedit).
   • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MuseHubUpdater or the relevant service key for MuseHub.
   • Locate the ImagePath value.
   • Add quotes around the full path to the Muse.Updater.exe executable. For example:
     "C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe"
   • Restart the MuseHub service.
2. Monitor the service for any unusual activity.
3. Consider uninstalling MuseHub if the risk is deemed unacceptable and a patch is not released.

It is highly recommended to monitor Muse Group’s website or other reputable security news sources for any future updates or patches related to this vulnerability.