CVE-2016-20090

Executive Summary

CVE-2016-20090 is a privilege escalation vulnerability affecting the Comodo Dragon Browser up to version 52.15.25.663. The flaw resides in the DragonUpdater service, which runs with SYSTEM privileges and references an executable via an unquoted service path. A local attacker with the ability to write files to the filesystem can place a malicious executable in a directory traversed by the unquoted path, resulting in arbitrary code execution with SYSTEM-level privileges upon service restart or system reboot. The vulnerability has a CVSS score of 8.5 and remains unpatched as of the latest available information.

Technical Analysis

The vulnerability is a classic unquoted service path privilege escalation flaw, classified under CWE-428 (Unquoted Search Path or Element). The DragonUpdater service installed by Comodo Dragon Browser versions up to 52.15.25.663 is configured to execute a binary located at a file path that contains spaces but is not enclosed in quotation marks within the service's image path registry entry.

When Windows resolves an unquoted service path, the operating system's CreateProcess function parses the path from left to right, treating each space as a potential argument delimiter. For each segment of the path, the system attempts to execute the corresponding executable by appending ".exe" to the partial path. For example, if the service path is "C:\Program Files\Comodo\Dragon Updater.exe", the system will attempt to launch, in order: "C:\Program.exe", "C:\Program Files\Comodo\Dragon.exe", and finally "C:\Program Files\Comodo\Dragon Updater.exe".

The DragonUpdater service runs with SYSTEM privileges, which is the highest privilege level on a Windows system. Because the service path is unquoted, a local attacker who can create files in writable directories that fall within the path traversal sequence can place a malicious executable named to match one of the intermediate path segments (e.g., "Program.exe" or "Dragon.exe" in the appropriate directory). When the service is restarted or the system is rebooted, Windows will execute the attacker-controlled binary with SYSTEM privileges instead of the legitimate updater.

The attack surface is exclusively local — the attacker must have the ability to write files to the filesystem on the target machine. This typically requires at least standard user-level privileges. No network exposure is involved, and no remote exploitation vector exists for this vulnerability. The NVD description does not provide additional implementation details, function names, or specific registry key paths beyond the service name.

Exploitation Scenarios

No public exploit code or PoC has been identified for CVE-2016-20090. The attack chain described below is inferred from the vulnerability class (unquoted service path) and the details provided in the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker with local access to a system running Comodo Dragon Browser (version 52.15.25.663 or earlier) identifies the presence of the DragonUpdater service. This can be accomplished using standard Windows utilities such as sc query or through PowerShell commands that enumerate services and their associated binary paths. The attacker looks for service entries where the path contains spaces and is not enclosed in quotation marks. The DragonUpdater service is the primary target.

Step 2 — Triggering the Flaw Class: The attacker determines the full, unquoted path of the DragonUpdater service binary. Based on the unquoted service path vulnerability class, the attacker identifies the intermediate directories along the path where they have write permissions. In typical installations, the path may begin with "C:\Program Files" or similar directories; however, the attacker must locate a writable position within the path structure. If the service binary resides at a path like "C:\Program Files\Comodo\Dragon Updater.exe" and the attacker has write access to the C:\ root or the C:\Program Files directory, they can plant a malicious executable at one of the intermediate resolution points.

Step 3 — Payload / Execution Method: At the vulnerability-class level, the attacker creates a malicious executable file named to match one of the intermediate path segments — for instance, placing a binary named "Program.exe" in the C:\ root directory or "Comodo.exe" or "Dragon.exe" within the appropriate parent directory. The malicious executable can be any payload — a reverse shell, a credential-theft tool, a backdoor, or ransomware. The naming must correspond exactly to the path segment that Windows will attempt to resolve. Upon service restart or system reboot, the Windows Service Control Manager will execute the attacker-controlled binary instead of the legitimate updater.

Step 4 — Post-Exploitation Impact: Because the service runs with SYSTEM privileges, the malicious executable inherits the highest privilege level on the Windows host. The attacker gains complete control over the system, including the ability to create new user accounts, disable security software, exfiltrate sensitive data, install persistent malware, move laterally across the network, and potentially compromise other connected systems. The privilege escalation is one-way: from a low-privileged local user to full SYSTEM-level access.

It is important to note that no public PoC exists, and the attack chain presented here is inferred purely from the vulnerability class and the NVD description. Specific filesystem paths, service binary names, and registry locations beyond those stated in the description are not confirmed.

Impact Assessment

CVE-2016-20090 presents a high-severity local privilege escalation risk for all systems running Comodo Dragon Browser version 52.15.25.663 or earlier. The CVSS score of 8.5 reflects the critical nature of the privilege escalation: any local user with standard access privileges can escalate to SYSTEM-level control of the affected host.

The impact is scored as follows: the attack vector is Local (AV:L), the attack complexity is Low (AC:L), no user interaction is required (UI:N), and the attacker needs only low-level privileges (PR:L) to initiate the exploit. The scope is Changed (S:C), meaning the compromised component (the service) can impact resources beyond its security boundary — in this case, the entire operating system. The confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), reflecting that a successful exploit grants full control over the host.

From a business perspective, the primary risk is to end-user workstations and any systems where Comodo Dragon Browser has been deployed. Given that the browser is a consumer-focused product, enterprise deployment may be limited, but any organization that has installed it on managed endpoints is exposed. An attacker who successfully exploits this vulnerability can bypass all application whitelisting, antivirus protections, and user access controls, potentially leading to data breaches, ransomware deployment, or lateral movement into the corporate network.

The vulnerability has an EPSS score of 0.00175, placing it at the 7.2nd percentile of exploited CVEs — indicating that exploitation in the wild is not currently widespread. It is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor campaigns have been publicly attributed to this CVE.

Detection Guidance

The detection rules below are designed to identify attempts to exploit the unquoted service path vulnerability. Because the exploitation is local and involves filesystem manipulation and service manipulation, detection focuses on abnormal process creation, service enumeration, and file creation in sensitive directories.

Sigma Rule

title: Unquoted Service Path Privilege Escalation - Potential Exploitation
id: 3f7a9b2c-8e11-4d6a-9f5d-2c1a7b9e4f20
status: experimental
description: Detects potential exploitation of the DragonUpdater unquoted service path vulnerability in Comodo Dragon Browser.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-20090
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_service_enumeration:
        Image|endswith:
            - '\sc.exe'
            - '\powershell.exe'
        CommandLine|contains|all:
            - 'query'
            - 'Dragon'
    selection_suspicious_execution:
        Image|startswith:
            - 'C:\Program.exe'
            - 'C:\Program Files\Comodo\Dragon.exe'
            - 'C:\Program Files\Comodo\Dragon Updater.exe'
    selection_system_process:
        User|contains:
            - 'AUTHORITY\SYSTEM'
        Image|contains:
            - 'Program.exe'
            - 'Dragon.exe'
    condition: selection_suspicious_execution and selection_system_process or selection_service_enumeration
level: high
falsepositives:
    - Legitimate Comodo Dragon Browser updates spawning from the correct service path
    - Benign use of sc.exe to query services
fields:
    - CommandLine
    - ParentImage
    - User
    - Image
tags:
    - attack.privilege_escalation
    - attack.t1068

YARA Rule

rule CVE_2016_20090_Comodo_Dragon_Unquoted_Service_Path
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects potential malicious binaries named to exploit the DragonUpdater unquoted service path"
        cve = "CVE-2016-20090"
        date = "2024-01-15"
        severity = "high"

    strings:
        $s1 = "DragonUpdater" nocase
        $s2 = "Unquoted" nocase
        $s3 = "Service" nocase
        $s4 = "Comodo" nocase
        $s5 = "Program.exe" nocase
        $s6 = "Dragon.exe" nocase

    condition:
        (uint16(0) == 0x5A4D and filesize < 5MB and 1 of ($s1, $s4, $s5, $s6)) or
        (filesize < 1MB and ($s5 or $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2016-20090 - Potential Comodo Dragon Updater Malicious Download"; flow:established,to_client; content:"DragonUpdater"; nocase; content:".exe"; distance:0; http.uri; classtype:attempted-privilege-escalation; sid:2026015; rev:1; reference:cve,2016-20090;)

Elastic Detection

// Detect processes spawned from suspicious paths associated with unquoted service path exploitation
process where event.module == "endpoint"
    and event.action == "start"
    and user.name in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
    and (
        process.executable == "C:\\Program.exe"
        or process.executable == "C:\\Program Files\\Comodo\\Dragon.exe"
        or process.executable == "C:\\Program Files\\Comodo\\Dragon Updater.exe"
        or process.executable : "C:\\Program Files\\Comodo\\*"
    )
    and process.parent.name : ("services.exe", "svchost.exe")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
    OR index=windows EventCode=4688
    | where (New_Process_Name == "C:\\Program.exe"
        OR New_Process_Name == "C:\\Program Files\\Comodo\\Dragon.exe"
        OR New_Process_Name == "C:\\Program Files\\Comodo\\Dragon Updater.exe")
        OR (CommandLine LIKE "%DragonUpdater%")
    | table _time, User, New_Process_Name, CommandLine, Parent_Process_Name, Host
    | sort - _time

Wazuh OSSEC Rule

<group name="syscheck, windows, privilege_escalation,">
    <rule id="100215" level="12">
        <if_sid>550</if_sid>
        <field name="file">C:\Program.exe|C:\Program Files\Comodo\Dragon.exe</field>
        <description>CVE-2016-20090: Potential malicious executable created for unquoted service path exploitation (Comodo Dragon)</description>
        <group>ossec,syscheck,privilege_escalation,</group>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>

    <rule id="100216" level="10">
        <if_sid>571</if_sid>
        <match>DragonUpdater</match>
        <description>CVE-2016-20090: Suspicious service modification attempt related to DragonUpdater</description>
        <group>ossec,windows,privilege_escalation,</group>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch, vendor fix, or official mitigation has been identified from any tracked source. The vulnerability remains open in all affected versions of Comodo Dragon Browser up to and including 52.15.25.663.

Immediate Mitigations:

1. Uninstall or Replace the Product: The most effective immediate mitigation is to uninstall Comodo Dragon Browser entirely, or replace it with a maintained alternative browser that receives active security patches.
2. Restrict Local Write Access: If the browser must remain installed, restrict write access to the directories that could be leveraged for exploitation — specifically the C:\ root and any intermediate directories in the DragonUpdater service path. Ensure standard users do not have write permission to these locations.
3. Disable the DragonUpdater Service: Stop and disable the DragonUpdater Windows service. This removes the exploit target entirely, though it also disables browser updates, which carries its own security risk.
4. Modify the Service Path: As a system administrator, edit the service configuration to enclose the binary path in quotation marks. This is a manual workaround that prevents the unquoted path resolution. Use the Service Control Manager (sc.exe config DragonUpdater binPath= "\"C:\Program Files\Comodo\Dragon Updater.exe\"") or the registry.

Patch/Upgrade Steps:

• Check the Comodo website for any updated versions of Dragon Browser that may have addressed this issue. The CVE description states the flaw exists through version 52.15.25.663 — verify whether any later version remediates the unquoted service path.
• If no patched version is available, the recommended course of action is to uninstall the software and migrate to a supported browser.

Long-Term Hardening:

• Implement application whitelisting (e.g., Windows Defender Application Control, AppLocker) to prevent unauthorized executables from running from writable directories.
• Enforce least-privilege principles: standard users should never have write access to system root directories or Program Files.
• Conduct regular privilege-escalation assessments using tools such as PowerUp or WinPEAS to identify unquoted service paths and other common local privilege escalation vectors across the fleet.
• Maintain a robust endpoint detection and response (EDR) solution that monitors for abnormal service modifications and process creation.
• Ensure all browser software in the enterprise is covered by a patch management policy, and remove unsupported or deprecated software from managed endpoints.

References

1. NVD Entry — CVE-2016-20090: https://nvd.nist.gov/vuln/detail/CVE-2016-20090
2. ATT&CK Technique T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
3. CWE-428 — Unquoted Search Path or Element: https://cwe.mitre.org/data/definitions/428.html
4. FIRST EPSS — CVE-2016-20090: https://first.org/epss/api
5. Comodo Dragon Browser Product Page: https://www.comodo.com/home/browsers-toolbars/browser.php

Threat Actor Evidence: No known threat actor campaigns have been publicly attributed to CVE-2016-20090. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no exploits in the wild have been confirmed as of this report's writing.