Re: cygrunsrv CWE-428

On Mon, Apr 20, 2026 at 9:43 AM James Warnock wrote:

We use cygwin including installing some services via cygrunsrv. We have had
> some users run vulnerability scans which flag the installed services due to
> an unquoted service path (CWE-428 [1]). I haven't been able to find any
> discussion of this in the archives except for the "cygrunsrv -L outputs
> nothing if service paths are quoted" [2]. In that message, another user
> manually added quotes to resolve the vulnerability scan but then 'cygrunsrv
> -L' no longer listed installed services. That issue was fixed.
>
> I did come up with a simple patch (attached) that worked for my limited
> use case. But there may be considerations for global usage of which I am
> unaware.
>
> Should cygrunsrv be updated to automatically include the quotes?


Probably a good idea for a future update, if only to silence these dubious
"vulnerabilities" that get flagged by these scanners.

In the meantime, for those who might find it useful, I wrote a JScript
script that you can run as a GPO startup script that corrects this
"vulnerability" for all services on a machine (including services run by
cygrunsrv):

https://gist.github.com/Bill-Stewart/9379a8df293de418ed96ee6ea82c4459

Bill

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple