CVE-2020-15645

Executive Summary

CVE-2020-15645 is a critical remote code execution vulnerability in Marvell QConvergeConsole 5.5.0.64. The flaw resides in the getFileFromURL method of the GWTTestServiceImpl class, where improper validation of user-supplied paths allows authenticated attackers to perform arbitrary file operations. Successful exploitation bypasses the existing authentication mechanism and results in code execution with SYSTEM privileges. This vulnerability is unpatched, carries a CVSS score of 8.8, and has a high probability of being exploited based on its EPSS percentile ranking of 95.4%.

Technical Analysis

The vulnerability is rooted in a path traversal/arbitrary file access flaw within the GWTTestServiceImpl class of Marvell QConvergeConsole. The specific method affected is getFileFromURL, which processes user-supplied path inputs during file operations. The lack of proper validation on these paths permits an attacker to traverse directory structures and access files outside the intended scope.

Key technical characteristics:

• Vulnerability Class: Path traversal with arbitrary file read/write capabilities (CWE-22)
• Attack Vector: Network-based, remotely exploitable
• Authentication Requirement: Authentication is required, but the authentication mechanism can be bypassed as part of the exploit chain
• Privilege Context: Code executes in the context of the SYSTEM account
• Root Cause: Missing or inadequate validation of user-supplied paths before they are used in file operations within the getFileFromURL method

The GWTTestServiceImpl class suggests this is part of the GWT (Google Web Toolkit) service implementation used for testing functionality. The getFileFromURL method name implies the service retrieves files from URLs, and the attack likely involves manipulating the path component of file access requests to escape intended directories.

The "ZDI-CAN-10553" identifier indicates this was reported through the Zero Day Initiative, suggesting the vulnerability was professionally researched and validated. The authentication bypass component is particularly concerning as it lowers the barrier to exploitation.

Exploitation Scenarios

1. Reconnaissance and Target Identification

Attackers would first identify Marvell QConvergeConsole instances exposed to the network. Shodan searches for console interfaces or GWT service endpoints would reveal potential targets. The console is typically deployed in enterprise storage environments, making it a high-value target.

2. Triggering the Vulnerability

The attack chain begins with an authenticated session to the QConvergeConsole. The attacker invokes the getFileFromURL method of the GWTTestServiceImpl class. By manipulating the path parameter passed to this method — specifically by using path traversal sequences or absolute paths — the attacker can cause the service to access files outside the intended application directory.

The authentication bypass aspect suggests the attacker can either:

• Exploit a separate flaw in the authentication mechanism to gain initial access
• Use elevated privileges within the compromised session to escalate to the getFileFromURL functionality

3. Payload and Execution Method

Since the flaw allows arbitrary file operations, the attacker can:

• Read sensitive system files to harvest credentials and system information
• Write malicious files to the target system, particularly in locations that will be executed automatically (e.g., startup directories, service binaries, or configuration files)
• Overwrite existing application files to inject malicious code

The final goal is code execution with SYSTEM privileges. The file write primitive can be leveraged to place a webshell or executable payload that executes in the SYSTEM context. Given the lack of a public PoC, the specific exploitation path must be inferred from the vulnerability class.

4. Post-Exploitation Impact

Once SYSTEM-level code execution is achieved:

• Full control of the affected server
• Access to connected storage infrastructure
• Potential lateral movement within the storage network
• Persistence mechanisms can be established
• Data exfiltration from managed storage systems

Note: No public PoC is available; this attack chain is inferred from the vulnerability class and description. The exact payload delivery and execution mechanism may differ in practice.

Impact Assessment

CVSS Score Analysis (8.8 — High)

The CVSS score reflects the severity:

• Attack Vector: Network — Remotely exploitable
• Attack Complexity: Low — No special conditions required
• Privileges Required: Low — Authentication bypass reduces access requirements
• User Interaction: None — No victim interaction needed
• Confidentiality, Integrity, Availability Impact: High — Full compromise potential

Business Impact

Marvell QConvergeConsole is a management tool for storage adapters and controllers. Compromise of this console provides attackers with:

1. Storage Infrastructure Access: The console manages FC and Ethernet adapters, meaning attackers gain visibility and potential control over SAN infrastructure
2. System Integrity Compromise: SYSTEM-level access means complete takeover of the host system
3. Data Exposure: Access to storage configuration and potentially stored data
4. Blast Radius: The compromised console could be a foothold into broader data center infrastructure

Criticality Assessment

• Unpatched Status: The vulnerability remains unpatched (patch confidence 0/4), meaning all installations of version 5.5.0.64 remain vulnerable indefinitely
• EPSS Probability: 95.4% percentile for exploitation likelihood
• No CISA KEV Listing: While not in the Known Exploited Vulnerabilities catalog, the high EPSS score suggests active risk

Detection Guidance

Sigma Rule

title: Marvell QConvergeConsole - Path Traversal in getFileFromURL
id: c6a4f1c3-2b8e-4d5a-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of CVE-2020-15645 in Marvell QConvergeConsole, targeting the getFileFromURL method with path traversal sequences.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15645
author: Valtersit Threat Intelligence
logsource:
    product: marvell
    service: qconvergeconsole
    category: web
detection:
    selection_method:
        http.request.body|contains: 'getFileFromURL'
    selection_traversal:
        http.request.body|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '..%2f'
    selection_condition:
        - selection_method
        - selection_traversal
    condition: all of selection_*
fields:
    - src_ip
    - dst_ip
    - http.request.body
falsepositives:
    - Legitimate file operations on encoded paths
level: high
tags:
    - attack.t1190
    - cve.2020.15645
    - cwe.22

YARA Rule

rule Marvell_QConvergeConsole_CVE_2020_15645
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads and traffic patterns associated with CVE-2020-15645 exploitation - path traversal in getFileFromURL"
        date = "2024-01-01"
        cve = "CVE-2020-15645"
        severity = "critical"
    
    strings:
        $method = "getFileFromURL" ascii wide nocase
        $class = "GWTTestServiceImpl" ascii wide nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "%2e%2e" ascii nocase
        $system_ref = "SYSTEM" ascii wide nocase
    
    condition:
        any of ($method, $class) and any of ($traversal*)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT Marvell QConvergeConsole getFileFromURL Path Traversal (CVE-2020-15645)";
    flow:established,to_server;
    content:"getFileFromURL"; http_uri;
    content:"GWTTestServiceImpl"; http_uri;
    content:!"Windows_NT";
    pcre:"/(\.\.(\/|\\)|%2e%2e%2f)/i";
    reference:cve,2020-15645;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2020-15645;
    classtype:attempted-admin;
    sid:90000001;
    rev:1;
    metadata:created_at 2024-01-01;
)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5s
  [network where event.category == "network" and process.name == "java" and 
   network.protocol == "http" and 
   url.path contains "getFileFromURL" and 
   url.path contains "GWTTestServiceImpl"]
  [file where event.category == "file" and 
   process.name == "java" and 
   file.path regex~ "\.\.(%2f|/|\\|\x5c)" and 
   file.extension == ("exe", "dll", "bat", "cmd", "ps1", "jsp", "jspx")]

Splunk SPL Query

index=web OR index=proxy 
| search "getFileFromURL" OR "GWTTestServiceImpl"
| rex field=_raw "(?i)(\.\./%2f|\.\./|\.\.\\|%2e%2e%2f)"
| where isnotnull(uri_path) OR isnotnull(http_request)
| stats count by src_ip, dest_ip, uri_path, http_method, _time
| eval cve_reference = "CVE-2020-15645"
| table _time, src_ip, dest_ip, http_method, uri_path, count
| sort -_time

Wazuh OSSEC Rule

<group name="marvell,qconvergeconsole,exploitation,">
  <rule id="100501" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*getFileFromURL.*</field>
    <field name="url">\.*(\.\./|\.\.\\|%2e%2e%2f).*</field>
    <description>Marvell QConvergeConsole: Path traversal attempt detected via getFileFromURL (CVE-2020-15645)</description>
    <group>exploit_attempt,cve_2020_15645,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
  
  <rule id="100502" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">GWTTestServiceImpl</field>
    <description>Marvell QConvergeConsole: Access to GWTTestServiceImpl detected</description>
    <group>reconnaissance,cve_2020_15645,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — No patch evidence from any tracked source. All installations of Marvell QConvergeConsole 5.5.0.64 remain vulnerable.

1. Immediate Mitigations

• Network Segmentation: Restrict access to QConvergeConsole management interfaces to trusted administrative networks only. Block external access to ports used by the console.
• Access Control Enforcement: Implement strict firewall rules preventing unauthorized IPs from reaching the console. Use jump hosts for administrative access.
• Disable Unused Services: If GWT testing services are not required in production, disable the GWTTestServiceImpl or the entire GWT test subsystem.
• Credential Hardening: Enforce strong multi-factor authentication for all console accounts. Do not rely solely on the built-in authentication mechanism.
• Monitoring: Deploy log monitoring to detect path traversal attempts and unusual file access patterns on systems running QConvergeConsole.

2. Patch/Upgrade Steps

• Vendor Contact: Contact Marvell support to inquire about updated versions or security patches. As of the latest tracked data, no fix has been released.
• Version Migration: If possible, migrate to an alternative management platform or upgrade to a newer version if one becomes available.
• Timeline: Re-evaluate patching status on a regular basis. Monitor vendor advisories and ZDI publication channels for updates.

3. Long-Term Hardening

• Security Review: Conduct a comprehensive security assessment of all Marvell management interfaces in the environment.
• Least Privilege: Limit administrative access to storage management systems. Use dedicated, isolated management networks.
• Vendor Accountability: Escalate the unpatched status to senior leadership and contract management. Document risk acceptance if system must remain operational.
• Compensating Controls: Deploy WAF rules to block path traversal attempts targeting the management console. Ensure IDS/IPS signatures are updated.
• Disaster Recovery: Ensure backups are taken from the storage infrastructure independent of the QConvergeConsole to avoid single points of failure in management.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-15645 — Official NVD record with CVSS score and description.

2. ZDI Advisory (ZDI-CAN-10553): https://www.zerodayinitiative.com/advisories/published/ — Zero Day Initiative publication reference for the vulnerability case number.

3. Marvell Advisory: https://www.marvell.com/support — Marvell support portal for checking security updates and patch availability.

4. EPSS Data: https://www.first.org/epss/ — FIRST EPSS score reference for exploitation probability (95.4% percentile).

5. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CISA KEV catalog (note: CVE-2020-15645 is NOT currently listed, but should be monitored for updates).

Threat Actor Campaigns: No known threat actor campaigns have been publicly attributed to this vulnerability. No exploit-in-the-wild evidence has been reported. However, the high EPSS percentile and unpatched status make this vulnerability attractive for future exploitation.