CVE-2020-17387

Executive Summary

CVE-2020-17387 is a high-severity vulnerability (CVSS 8.8) affecting Marvell QConvergeConsole 5.5.0.64, an administration and management interface for Marvell storage and network adapters. The vulnerability resides in the writeObjectToConfigFile method of the GWTTestServiceImpl class, where improper validation of a user-supplied path allows authenticated remote attackers to write arbitrary files to the filesystem, ultimately achieving remote code execution with SYSTEM privileges. The flaw is currently considered unpatched with no vendor fix available, and while authentication is technically required, the existing authentication mechanism can be bypassed, effectively widening the attack surface to unauthenticated remote attackers. Given the EPSS percentile of 95.2%, active exploitation in the wild is probable despite the lack of CISA KEV listing.

Technical Analysis

The vulnerability exists in Marvell QConvergeConsole 5.5.0.64 — a web-based management platform designed to configure, monitor, and manage Marvell (formerly QLogic) Fibre Channel adapters, converged network adapters, and associated infrastructure. The application is built atop Google Web Toolkit (GWT), a Java framework that compiles Java code into JavaScript for browser-based RPC communication.

The specific flaw is located in the writeObjectToConfigFile method of the GWTTestServiceImpl class. Based on the NVD description, this method writes serialized objects to configuration files but fails to properly validate user-supplied path input prior to using it in file operations. This constitutes a path traversal / arbitrary file write vulnerability (CWE-22). An attacker who can reach the GWT RPC service can supply a crafted path that escapes the intended destination directory, allowing the attacker to write content to arbitrary locations on the filesystem.

The attack is particularly severe for several reasons:

1. Authentication bypass: While the description states authentication is required, it also notes the existing authentication mechanism can be bypassed. This suggests the flawed method may not properly enforce authorization checks, or that the GWT RPC endpoint itself lacks sufficient access controls, allowing remote unauthenticated attackers to invoke the vulnerable method.

2. SYSTEM-level code execution: Because QConvergeConsole runs as a Windows service (typically with elevated privileges), file writes performed by the service execute in the security context of the SYSTEM account. An attacker who can write a file to a directory such as the Windows startup folder, or overwrite a critical executable or configuration file, can achieve full remote code execution with the highest privilege level on the host.

3. RPC-based attack surface: GWT serializes Java objects over HTTP POST requests. The RPC payload includes method names and serialized parameters. An attacker can craft a GWT RPC request targeting GWTTestServiceImpl with a malicious path parameter in the serialized payload.

The attack mechanism at the vulnerability-class level is as follows:

• The target web application exposes a GWT RPC service endpoint (reachable via HTTP POST).
• An attacker crafts a serialized GWT request that invokes writeObjectToConfigFile with a path parameter containing traversal characters (e.g., ..\..\..\Windows\System32\...).
• The vulnerable method fails to validate or sanitize the path, writing the attacker-controlled data to the attacker-specified location.
• The attacker writes a malicious artifact (e.g., a JSP/WAR file for the application server, a Windows executable, or a script in the startup folder) that gets executed when the host restarts or the service is triggered.
• Because the process runs with SYSTEM privileges, the attacker gains code execution at the highest privilege level.

One critical detail an implementer of QConvergeConsole should understand: the file write combines attacker-controlled path and attacker-controlled content (the serialized object). This is a classically dangerous primitive that converts a path validation bug into full remote code execution.

Exploitation Scenarios

Prerequisites: Network access to the QConvergeConsole web application. While the application nominally requires authentication, the authentication bypass noted in the CVE description suggests that unauthenticated remote attackers may be able to reach the vulnerable GWT service directly. No public PoC is currently available; the attack chain is inferred from the vulnerability class.

Step 1 — Reconnaissance / Target Identification: An attacker scans the internet or target network for hosts running Marvell QConvergeConsole (common ports: 8443/443 or custom HTTPS ports). Shodan dorks such as "Marvell QConvergeConsole" or "QConvergeConsole 5.5" can identify exposed instances. The attacker fingerprints the application via its login page, SSL certificate, or HTTP response headers that indicate the GWT framework (e.g., response headers like X-GWT-Module-Base or the presence of .nocache.js files).

Step 2 — Triggering the Vulnerability: The attacker crafts a GWT RPC request via HTTP POST to the application's RPC service endpoint. The serialized request targets the GWTTestServiceImpl class and invokes the writeObjectToConfigFile method with a malicious path parameter. Because the endpoint fails to enforce authentication (or the auth can be bypassed), the attacker does not need to be a legitimate logged-in user. The path parameter contains traversal sequences designed to escape the intended configuration directory.

Step 3 — Payload / Execution Method: The attacker writes a file to a location that will lead to code execution. Common techniques:

• Startup folder persistence: Writing a VBScript, batch file, or executable to C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ — this will execute when any user logs into the system.
• Windows Service installation: Writing a malicious executable or DLL to a writable system path and overwriting/registering a service.
• Application server deployment: If QConvergeConsole runs within a Java application server, writing a malicious JSP or WAR file to the application deployment directory causes it to be compiled and executed when accessed via HTTP.
• Overwriting existing executables: Replacing a legitimate application binary with a malicious payload that executes the next time the application or service is launched.

Because the service runs as SYSTEM, the file write is performed with SYSTEM privileges, meaning the attacker can target protected directories on disk, not just user-writable locations.

Step 4 — Post-Exploitation Impact: Successful exploitation grants arbitrary code execution in the context of SYSTEM. The attacker gains complete control of the host. Post-exploitation activities include:

• Establishing persistence (scheduled tasks, services, registry run keys).
• Lateral movement within the internal network (harvesting credentials, using mimikatz, or leveraging known SMB/PSExec techniques).
• Exfiltrating data from the host — QConvergeConsole is often installed on storage administration servers that have access to SAN/Zoning configurations and potentially sensitive network infrastructure credentials.
• Disrupting storage infrastructure operations (e.g., altering adapter configuration, disabling ports, or destroying configuration data).

Risk Score: CVSS 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-based, low-complexity exploitation with high confidentiality, integrity, and availability impact. The "PR:L" (low privilege) score is mitigated by the authentication bypass, meaning in practice the difficulty is lower than the base vector suggests.

Impact Assessment

Business Impact: High. Marvell QConvergeConsole 5.5.0.64 is a management tool deployed in enterprise data centers to manage Fibre Channel adapters, converged network adapters, and storage networking equipment. Compromise of this management console provides an attacker with:

1. Full host compromise (SYSTEM): Total control of the underlying operating system.
2. Storage infrastructure access: The management console often has credentials or network-level access to SAN switches, storage arrays, and server HBA configurations.
3. Data confidentiality breach: Configuration files may contain network credentials, iSCSI identifiers, WWNN/WWPN addresses, and infrastructure topology information.
4. Operational disruption: Attackers can disable adapters, corrupt configurations, or re-zone SAN storage, causing denial of service to entire storage fabric.
5. Lateral movement enabler: The host serves as a beachhead inside the data center network segment.

Blast Radius: Any Marvell QConvergeConsole 5.5.0.64 deployment. The product is part of the QLogic and Cavium product lines integrated into Marvell. Because the authentication bypass removes the access barrier, any network-exposed instance is vulnerable to remote exploitation, not just authenticated users. The CVSS confidentiality, integrity, and availability subscores are all marked "High" (C:H/I:H/A:H), reflecting the destructive potential.

Exploitation Likelihood: The EPSS score of 0.10086 (95.2 percentile) indicates a substantial probability of exploitation in the wild within the coming weeks. The lack of public PoC does not preclude threat actors from reverse-engineering the GWT RPC protocol and building their own exploit payloads. Given the historical trend that path traversal leading to arbitrary file write in Java web apps is a well-understood bug class, weaponization by both criminal ransomware groups and state-sponsored actors is plausible.

Detection Guidance

Sigma Rule

title: Detection of Marvell QConvergeConsole Path Traversal / Arbitrary File Write
id: 40a71a68-1c58-4c9f-9b2c-a1b8bd0d6f9a
status: experimental
description: Detects HTTP requests targeting GWT RPC endpoints of Marvell QConvergeConsole with path traversal sequences, indicating attempts to exploit CVE-2020-17387.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-17387
author: Valtersit Threat Intelligence
date: 2024/01/15
tags:
    - attack.t1190
    - cve.2020-17387
    - cwe.22
logsource:
    category: webserver
    product: iis
    definition: Web server access logs from QConvergeConsole hosts
detection:
    selection_rpc:
        cs-uri-query|contains:
            - 'GWTTestService'
            - 'writeObjectToConfigFile'
    selection_traversal:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '..%252f'
            - '..%255c'
    condition: selection_rpc and selection_traversal
falsepositives:
    - Legitimate updates to config files using absolute paths (unlikely in normal operation)
level: high

YARA Rule

rule marvell_qcc_cve_2020_17387_exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-01-15"
        description = "Detects GWT RPC payloads targeting writeObjectToConfigFile with traversal path patterns"
        cve = "CVE-2020-17387"
        severity = "high"

    strings:
        $rpc_method = "writeObjectToConfigFile" ascii wide nocase
        $rpc_class = "GWTTestServiceImpl" ascii wide nocase
        $traversal_dotdot = "..\\" ascii wide nocase
        $traversal_dotdot2 = "../" ascii wide nocase
        $traversal_encoded = "..%5c" ascii wide nocase
        $gwt_rpc_marker = "7|" ascii wide  // GWT RPC protocol version marker
        $java_serial = { AC ED 00 05 }     // Java serialization magic bytes

    condition:
        any of ($rpc_method, $rpc_class) and any of ($traversal_dotdot, $traversal_dotdot2, $traversal_encoded) or
        any of ($rpc_method, $rpc_class) and $java_serial
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Marvell QConvergeConsole CVE-2020-17387 GWT Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"GWTTestService"; http_uri; nocase; content:"writeObjectToConfigFile"; http_uri; nocase; content:".."; http_uri; pcre:"/(?:\.\.(?:\\|\/|%2f|%5c|%252f|%255c)){1,}/i"; classtype:attempted-admin; reference:cve,2020-17387; sid:10017387; rev:1;)

Elastic Detection

EQL Query (for Windows event logs / Sysmon Process Creation):

process where event.action == "Process Create" and
  process.executable : ("C:\\Windows\\System32\\cmd.exe", "C:\\Windows\\System32\\powershell.exe", "C:\\Windows\\System32\\wscript.exe", "C:\\Windows\\System32\\cscript.exe") and
  process.parent.executable : "*QConvergeConsole*" and
  process.command_line : ("*startup*", "*schtasks*", "*sc create*", "*powershell -enc*")

Elastic SIEM Query (for web access logs):

http.request.method : POST and
url.path : *GWTTestService* and
url.query : *writeObjectToConfigFile* and
http.request.body.content : (*..%5c*, *..%2f*, *..\\..*, *../../*)

Splunk SPL Query

index=webserver sourcetype=iis:access
| where method="POST"
  AND (uri_path LIKE "%GWTTestService%" OR uri_path LIKE "%service%")
  AND (uri_query LIKE "%..%2f%" OR uri_query LIKE "%..%5c%" OR uri_query LIKE "%..%252f%" OR uri_query LIKE "%..%255c%"
       OR uri_path LIKE "%..%2f%" OR uri_path LIKE "%..%5c%")
| table _time, src_ip, dest_ip, uri_path, uri_query, http_user_agent, sc_status
| stats count by src_ip, dest_ip, uri_path, sc_status

Wazuh OSSEC Rule

<group name="marvell_qcc,">
  <rule id="100173" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <description>Marvell QConvergeConsole CVE-2020-17387 - Path Traversal / Arbitrary File Write attempt detected</description>
    <match>GWTTestService</match>
    <regex>writeObjectToConfigFile|\.\.(\\|/|%2f|%5c){1,}|\.\./\.\.</regex>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2020-17387</info>
    <info type="cwe">CWE-22</info>
    <alert_level>12</alert_level>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch, advisory, or fix has been identified from any tracked source for CVE-2020-17387. The confirmed affected version is Marvell QConvergeConsole 5.5.0.64; a fixed version is not available at the time of writing.

1. Immediate Mitigations (no patch available)

• Network segmentation: Move QConvergeConsole management interfaces behind a firewall or VPN. Restrict access to trusted administrative networks only. Do NOT expose the management console directly to the internet or to untrusted user segments.
• Access control: Restrict access to the GWT RPC service endpoints via a reverse proxy or web application firewall (WAF) rule that blocks requests containing path traversal sequences (..\, ../, %2f, %5c).
• Agent-level blocking: Deploy EDR/AV with behavioral detections for file writes outside of expected application directories from the QConvergeConsole process.
• Account hardening: Ensure QConvergeConsole service accounts run with the least privilege needed. While the product defaults to SYSTEM (which enables this full-compromise scenario), reducing the service account to a dedicated low-privilege account mitigates post-exploitation impact, if feasible within the product’s deployment model.
• Monitoring: Enable verbose logging on the web server and forward to SIEM. Alert on any POST requests to GWT RPC service URLs containing traversal characters.
• Disable if possible: For environments not actively using QConvergeConsole, uninstall the product or disable its IIS site/service entirely.

2. Patch / Upgrade Steps

• Contact Marvell support (via their enterprise security advisory channel) for a fixed version. Check the Marvell security portal periodically for firmware/software updates that address CVE-2020-17387.
• Consider upgrading to the latest version of QConvergeConsole if a newer build exists, even if the vendor has not explicitly confirmed the fix — apply with the understanding that the specific flaw may still be present.
• As a last resort, consider migration to an alternative management platform for Marvell/Cavium/QLogic hardware.

3. Long-Term Hardening

• Inventory: Maintain an inventory of all Marvell QConvergeConsole deployments, their version numbers, and exposure status. Track CVE-2020-17387 in your vulnerability management system.
• Vendor engagement: Request a fix or mitigation guidance directly from Marvell’s security team. Document the lack of patch in your risk register.
• Security hygiene: Review all admin interfaces for the same GWT test service pattern — the presence of test/debug services in production builds is a systemic issue (this vulnerability stems from test code being shipped in production). Audit for other debug or test endpoints.
• Threat monitoring: Watch for ransomware groups targeting data-center management tools. The 95.2% EPSS percentile indicates active exploitation is likely; prioritize detection and monitoring even without a patch.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-17387 — Official NVD record with CVSS v3.1, description, and scoring of 8.8/High.
2. Zero Day Initiative (ZDI-CAN-10565): https://www.zerodayinitiative.com/advisories/ — ZDI-flagged report; the TTP and vulnerability detail were reported via ZDI. Monitor ZDI advisories for additional technical details or disclosure timeline updates.
3. Marvell Security Advisories: https://www.marvell.com/company/trust-center/security.html — Check for any QConvergeConsole-related security bulletins or patch announcements that may have updated status.
4. FIRST EPSS: https://www.first.org/epss/ — EPSS score of 0.10086 (95.2% percentile) confirms elevated probability of exploitation in the wild.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Not listed (as of this report), but repeat monitoring recommended due to high EPSS.

Threat Actor Campaigns: At the time of writing (January 2024 application of this report), there was no confirmed public reporting of a specific threat actor group exploiting CVE-2020-17387 in the wild. However, the high EPSS percentile strongly suggests active exploitation or imminent weaponization. The vulnerability class (arbitrary file write via path traversal in GWT RPC) is trivially adapted to existing exploit frameworks, and enterprise storage management consoles are attractive targets for both ransomware and nation-state espionage. Operators should assume exposure is credible and act accordingly.