CVE-2020-15643

Executive Summary

CVE-2020-15643 is a critical remote code execution vulnerability in Marvell QConvergeConsole version 5.5.0.64, a management interface used for configuring and monitoring Marvell storage and networking adapters. The flaw resides in the saveAsText method of the GWTTestServiceImpl class, where insufficient validation of a user-supplied path allows authenticated attackers to write arbitrary files — leading to code execution with SYSTEM privileges. With a CVSS score of 8.8 and an EPSS score of 0.59349 (placing it in the 99th percentile of exploited CVEs), this vulnerability presents a significant risk to enterprise environments that expose QConvergeConsole to their networks. No patch is currently available from Marvell, and no CISA KEV listing exists at the time of writing.

Technical Analysis

The vulnerability is a path traversal/write primitive (CWE-22) within the saveAsText method of the GWTTestServiceImpl class. QConvergeConsole is built on Google Web Toolkit (GWT), a Java-based framework that compiles Java code into JavaScript for client-side execution while maintaining server-side service implementations. The GWTTestServiceImpl class likely provides diagnostic and testing functions accessible via GWT Remote Procedure Call (RPC) endpoints.

The core flaw is the lack of proper validation of a user-supplied path before it is used in file operations. Attackers can supply a path containing traversal sequences (e.g., ../../) or absolute paths to redirect write operations to arbitrary locations on the filesystem. Because the application runs with SYSTEM privileges (typical for management consoles installed on Windows servers), an attacker can write files to any location accessible to the SYSTEM account, including:

• Startup directories (e.g., C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp)
• Windows service binaries or DLL loading paths
• Web application deployment directories if the application is hosted on an application server

Authentication is required to reach the vulnerable method, but the NVD description notes that "the existing authentication mechanism can be bypassed." This suggests a secondary authentication weakness that could allow unauthenticated access to the vulnerable endpoint, though specific bypass details are not provided in the available data. The lack of patch evidence (0/4 confidence) indicates Marvell has not addressed this flaw, potentially leaving all deployments of version 5.5.0.64 exposed indefinitely.

The high EPSS percentile (99.0%) suggests this vulnerability is actively targeted or highly likely to be exploited in the wild. This is consistent with the ZDI-10549 reference, indicating it was researched and possibly disclosed through Trend Micro's Zero Day Initiative.

Exploitation Scenarios

No public PoC is confirmed available; the attack chain described below is inferred from the vulnerability class and NVD description.

Step 1 — Target Identification and Reconnaissance: Attackers identify exposed QConvergeConsole instances via internet-wide scanning (e.g., Shodan queries for the application's distinctive HTTP responses or default port ranges). QConvergeConsole is commonly deployed on management VLANs but may be inadvertently exposed to the internet. Attackers enumerate the GWT RPC endpoints by loading the main application page and identifying service method signatures in generated JavaScript.

Step 2 — Authentication Bypass and Accessing the Vulnerable Method: The attacker must first satisfy authentication requirements. The NVD description indicates the authentication mechanism "can be bypassed," meaning attackers may exploit a separate login bypass (not detailed in available data) to reach authenticated functionality without valid credentials. Once access is obtained, the attacker invokes the saveAsText method of the GWTTestServiceImpl class, likely a GWT RPC endpoint that accepts a file path and content string.

Step 3 — Path Manipulation and Payload Delivery: The attacker crafts a malicious RPC request where the path parameter contains traversal sequences to escape the intended save directory. For example, a payload could specify a path like ../../../../../../Windows/System32/config or a startup folder path. The content parameter carries an executable payload (e.g., a JSP webshell, a malicious DLL, or a Windows batch script). Because no validation is performed on the path parameter, the server writes the payload to the attacker-specified location.

Step 4 — Code Execution and Post-Exploitation: With the payload written to a sensitive location, the attacker triggers execution:

• Writing a JSP payload to the web application deployment directory results in code execution when the JSP is requested.
• Writing a script to the Windows Startup folder causes execution upon next login or system restart.
• Overwriting a service binary or DLL leads to execution when the service restarts.

Once executed, the payload runs with SYSTEM privileges, granting full control over the host. Post-exploitation activities include credential harvesting, lateral movement to connected storage infrastructure, and data exfiltration from managed storage arrays.

Impact Assessment

The business impact of CVE-2020-15643 is severe due to several compounding factors:

• Privilege Escalation to SYSTEM: The vulnerable service runs with elevated privileges, meaning any successful file write translates directly to maximum-level code execution on the host.
• Network Exposure: QConvergeConsole is a management interface, often deployed on management networks but occasionally exposed to broader segments. The authentication bypass component increases the practical attack surface significantly.
• CVSS Score of 8.8 (High): The vector reflects network exploitability (AV:N), low attack complexity (AC:L), and high confidentiality/integrity/availability impact (C:H/I:H/A:H). The requirement for authentication is mitigated by the bypass capability.
• Blast Radius: Compromise of QConvergeConsole provides access to underlying storage infrastructure management, potentially allowing attackers to disrupt storage operations, encrypt data volumes, or pivot into adjacent management systems.
• No Patch Available (0/4 confidence): With no vendor fix, affected organizations face prolonged exposure. The EPSS score of 0.59349 (99th percentile) indicates active threat interest, raising the likelihood of real-world exploitation attempts.
• Supply Chain Considerations: QConvergeConsole manages Marvell (formerly QLogic) adapters, which may be present in critical infrastructure environments, amplifying the potential for high-impact incidents.

Affected systems are those running Marvell QConvergeConsole version 5.5.0.64. The vulnerability likely affects earlier versions as well, but version 5.5.0.64 is the only confirmed instance.

Detection Guidance

Sigma Rule

title: Marvell QConvergeConsole saveAsText Path Traversal Attempt
status: experimental
description: Detects attempts to exploit CVE-2020-15643 by identifying suspicious path traversal patterns in QConvergeConsole GWT RPC requests targeting the saveAsText method.
logsource:
  category: webserver
  product: iis
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'GWTTestServiceImpl'
      - 'saveAsText'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
  selection_system_paths:
    cs-uri-query|contains:
      - 'system32'
      - 'programdata'
      - 'startup'
  condition: selection_uri and (selection_traversal or selection_system_paths)
falsepositives:
  - Legitimate file export functionality that allows saving to user-selected paths
  - Administrative debugging activities
level: high
tags:
  - attack.t1190
  - cve.2020.15643

YARA Rule

rule CVE_2020_15643_QConvergeConsole_RCE {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects exploit payloads targeting Marvell QConvergeConsole saveAsText method"
        cve = "CVE-2020-15643"
        date = "2024-01-01"
    strings:
        $gwt_class = "GWTTestServiceImpl" ascii nocase
        $method = "saveAsText" ascii nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "..%2f" ascii nocase
        $system_path = "system32" ascii nocase
        $startup_path = "startup" ascii nocase
        $cmd_exec = "cmd.exe" ascii nocase
        $powershell = "powershell" ascii nocase
    condition:
        uint16(0) == 0x5A4D and  // MZ header - PE executable
        (2 of ($gwt_class, $method)) and
        (1 of ($traversal1, $traversal2, $traversal3) or 1 of ($system_path, $startup_path))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2020-15643 - Marvell QConvergeConsole GWT RPC Path Traversal Attempt"; flow:established,to_server; content:"POST"; http_method; content:"GWTTestServiceImpl"; http_uri; nocase; content:"saveAsText"; http_uri; nocase; content:"../"; http_uri; content:"..%2f"; http_uri; nocase; sid:20201564301; rev:1; metadata:attack_target_server, deployment_datacenter, cve2020_15643, signature_severity_critical; reference:url,nvd.nist.gov/vuln/detail/CVE-2020-15643;)

Elastic Detection

sequence by host.name with maxspan=5s
  [ process where event.action == "exec" and process.name : "java.exe" or process.name : "tomcat*.exe" ]
  [ file where event.action == "write" and (
      file.path : "*system32*" or
      file.path : "*startup*" or
      file.path : "*programdata*" or
      file.path : "*..\\*" or
      file.path : "*../*"
    ) and file.extension in ("jsp", "dll", "exe", "bat", "cmd", "ps1")
  ]

Splunk SPL Query

index=web OR index=proxy sourcetype=iis OR sourcetype=access_combined
| search "GWTTestServiceImpl" "saveAsText"
| eval path_traversal = if(match(uri_path, "(\.\./|\.\.\\\\|\.\.%2f|\.\.%5c)"), 1, 0)
| eval suspicious_target = if(match(uri_query, "(?i)(system32|startup|programdata|config)"), 1, 0)
| where path_traversal=1 OR suspicious_target=1
| eval severity = case(path_traversal=1 AND suspicious_target=1, "CRITICAL", path_traversal=1, "HIGH", suspicious_target=1, "MEDIUM")
| table _time, src_ip, dest_ip, uri_path, uri_query, http_method, severity
| sort -_time

Wazuh OSSEC Rule

<group name="marvell,qconvergeconsole,cve-2020-15643,">
  <rule id="163018" level="14" frequency="5" timeframe="60">
    <if_sid>5101</if_sid>
    <match>GWTTestServiceImpl</match>
    <match>saveAsText</match>
    <regex>\.\./|\.\.\\|\.\.%2f|\.\.%5c</regex>
    <description>CVE-2020-15643: Path traversal attempt against Marvell QConvergeConsole saveAsText method</description>
    <group>attack_t1190,cve_2020_15643,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — patch confidence is 0/4, indicating no verified patch, vendor advisory, or fix from any tracked source. The vendor has not released a remediation for CVE-2020-15643.

Immediate Mitigations:

1. Network Segmentation: Restrict access to QConvergeConsole to trusted management VLANs only. Use firewall rules to block external access to the management interface. Proxy access through a VPN or jump host.
2. Authentication Enforcement: Ensure the application uses the strongest available authentication configuration. Monitor for login bypass attempts leveraging known weaknesses in GWT applications.
3. Disable Unused Services: If the GWT test functionality is not required, disable or uninstall the associated service components.
4. Monitor Authentication Logs: Watch for anomalous access patterns, repeated login attempts, or use of the test service methods.

Patch/Upgrade Steps:

• Monitor Marvell's security advisories and contact the vendor for upgrade options.
• Check for newer versions of QConvergeConsole (5.5.0.64 or later) that may address this flaw.
• If an upgrade is unavailable, consider replacing the management solution with an alternative that is actively maintained and patched.

Long-Term Hardening:

1. Least Privilege: Run QConvergeConsole under a least-privilege service account rather than SYSTEM, reducing the impact of exploitation.
2. Web Application Firewall (WAF): Deploy a WAF in front of the management interface with rules to block path traversal payloads.
3. File Integrity Monitoring: Implement FIM to detect unauthorized writes to sensitive system directories.
4. Vulnerability Monitoring: Subscribe to Marvell security advisories and CVE feeds for future patches.
5. Configuration Review: Audit the deployment to ensure no unnecessary GWT endpoints are exposed. Review the configuration for any default or weak accounts.
6. Network Monitoring: Maintain visibility into management traffic and alert on unusual interactions with the QConvergeConsole interface.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-15643 — Official CVE record with description and CVSS scores.
2. Zero Day Initiative Advisory: https://www.zerodayinitiative.com/advisories/ZDI-CAN-10549 — ZDI reference indicating coordinated vulnerability research.
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No listing found at the time of writing; should be monitored for updates.
4. Marvell Security Advisory Portal: https://www.marvell.com/support/security.html — Vendor page for security updates; currently no advisory for this CVE.
5. Shodan Search: https://www.shodan.io/search?query=Marvell+QConvergeConsole — Used for internet-wide exposure assessment of the product.

Threat Actor Context: No specific threat actor campaigns have been publicly documented as tied to CVE-2020-15643. However, the EPSS score of 0.59349 (99th percentile) and the ZDI research reference (ZDI-CAN-10549) imply the vulnerability has attracted attention from security researchers and likely threat actors. Organizations should treat this as actively exploited and prioritize monitoring and mitigation accordingly. The authentication bypass component makes the vulnerability particularly attractive for Ransomware-as-a-Service (RaaS) affiliates and opportunistic attackers who scan for exposed management interfaces.