CVE-2020-17389

Executive Summary

CVE-2020-17389 is a high-severity (CVSS 8.8) arbitrary file write/overwrite vulnerability in Marvell QConvergeConsole version 5.5.0.64. The flaw exists within the decryptFile method of the GWTTestServiceImpl class, where the application fails to properly validate a user-supplied path before using it in file operations. A remote authenticated attacker can exploit this flaw to write arbitrary files to the filesystem, ultimately achieving remote code execution in the context of SYSTEM. As of the latest intelligence, this vulnerability remains unpatched (patch confidence 0/4) and is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, though its EPSS score of 0.10086 (95.2nd percentile) indicates elevated exploitation likelihood.

Technical Analysis

The vulnerability resides in the GWTTestServiceImpl class of Marvell QConvergeConsole 5.5.0.64. The application is built on the Google Web Toolkit (GWT) framework, which exposes remote procedure call (RPC) services to clients over HTTP. The decryptFile method is part of this RPC surface — it is invoked when a client requests that a previously encrypted file be decrypted.

The root cause is a lack of proper validation of a user-supplied path parameter before using it in file operations. While the NVD description does not specify whether the flaw is a path traversal (e.g., ../ sequences) or an absolute path injection, the mechanism is consistent with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The application takes a path string from the attacker and passes it to file system APIs (via the decryptFile method) without confirming that the resolved path stays within an intended directory (e.g., a temporary directory or a designated share). This allows the attacker to specify arbitrary absolute paths or traverse outside the intended directory structure.

Because the affected service runs in the context of the Windows SYSTEM account (as is typical for management consoles installed as Windows services), any file operation the method performs inherits SYSTEM privileges. The attacker can leverage this to write a file to a location such as a startup directory, an IIS web root, or a scheduled task definition — any writable location that leads to code execution when the file is processed.

The authentication requirement is mitigated by a secondary issue noted in the ZDI advisory (ZDI-CAN-10502): the existing authentication mechanism can be bypassed. The NVD description states this explicitly, meaning that in practice, an unauthenticated remote attacker may be able to reach the vulnerable decryptFile method. This effectively removes the only barrier to exploitation, turning the requirement from "authenticated" to "potentially unauthenticated."

No code-level patch is available. The vendor has not released a fix, and no version beyond 5.5.0.64 has been identified as resolving the issue. The attack surface is the management console's HTTP interface, which is commonly exposed on internal networks but may also be internet-facing in misconfigured environments.

Exploitation Scenarios

Public proof-of-concept code has not been released, and no exploit code is known to exist in public repositories. The following attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker identifies Marvell QConvergeConsole instances by scanning for the service's default HTTP management ports (typically TCP/8443 for HTTPS or TCP/8080 for HTTP) via Shodan or similar services. Alternatively, the attacker may use the banner information returned by the application to fingerprint version 5.5.0.64. The attacker may also look for the presence of GWT-specific JavaScript endpoint paths (e.g., /qcc or similar), though such paths are not confirmed in public documentation.

Step 2 — Authentication Bypass and Trigger: The attacker first attempts to exploit the authentication bypass mechanism noted in the ZDI advisory. This may involve bypassing a login check by directly invoking the GWT RPC method, altering client-side session state, or manipulating cookies/tokens. Once access to the RPC surface is gained (or if authentication is successfully bypassed entirely), the attacker invokes the decryptFile method with a crafted request.

Step 3 — Payload Delivery: The attacker supplies a path parameter that resolves to an arbitrary location on the target filesystem. The path does not need to point to an existing file — the decryptFile method is used for both decryption and, in the context of the flaw, file writing. The attacker provides a payload in the body of the RPC request that will be decrypted and written to the attacker-specified path. Because the application lacks path validation, the attacker can set the path to, for example, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\evil.exe or C:\inetpub\wwwroot\shell.aspx. The write occurs with SYSTEM privileges.

Step 4 — Post-Exploitation: Once the malicious file is written, the attacker triggers its execution. If the payload is placed in a startup directory, a system restart (or user logon) executes it. If placed in a web root, the attacker makes an HTTP request to retrieve the payload, triggering server-side execution (e.g., a web shell). The resulting code runs in the context of SYSTEM, giving the attacker full control over the host. Post-exploitation would likely involve credential harvesting, lateral movement across the enterprise network (given that QConvergeConsole is a storage management tool likely deployed in data-center environments), and exfiltration of sensitive data stored on managed storage arrays.

It is important to note that no public PoC is available; this attack chain is inferred from the vulnerability class. The exact method to invoke decryptFile (request format, parameter names) is not publicly documented beyond the class and method names in the NVD description.

Impact Assessment

The CVSS score of 8.8 (High) reflects the combined impact of high confidentiality, integrity, and availability impacts, with a low attack complexity and no user interaction required. The attack vector is network-based; the only mitigating factor is the authentication requirement, which is itself bypassable per the NVD description.

From a business perspective, Marvell QConvergeConsole is a management tool for storage area network (SAN) and converged infrastructure. Its compromise grants SYSTEM-level control over the management server, which in turn has credentials and APIs to manage storage arrays. A successful exploit could allow an attacker to:

• Disrupt storage operations: Delete, encrypt, or expose logical unit numbers (LUNs), virtual volumes, and snapshot data.
• Move laterally: Use stored credentials to access Fiber Channel switches, other management consoles, and the storage arrays themselves.
• Establish persistence: Install backdoors or ransomware with SYSTEM privileges that survive reboots.
• Cause data integrity loss: Modify configuration files to corrupt storage services, causing data loss or outages.

The blast radius extends beyond the console host to the entire storage infrastructure managed by the console, which in enterprise environments can include petabytes of sensitive data. The lack of a patch exacerbates the risk, leaving every instance of version 5.5.0.64 exposed.

Detection Guidance

Detection should focus on anomalous file activity on the host running QConvergeConsole and on network traffic targeting the management console's web interface.

Sigma Rule

title: Marvell QConvergeConsole Arbitrary File Write Attempt
id: 4f9c2e5a-8d3b-4f6e-9c1a-2b8d7e5a4f3c
status: experimental
description: Detects file write operations outside expected application directories originating from the QConvergeConsole GWTTestServiceImpl decryptFile method.
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\tomcat\bin\java.exe'  # QCC typically runs on Tomcat
    selection_path:
        CommandLine|contains:
            - '\\Windows\\Start Menu\\'
            - '\\inetpub\\'
            - '\\ProgramData\\'
            - '\\Temp\\'
            - 'C:\Windows\System32\'
    selection_extension:
        CommandLine|endswith:
            - '.exe'
            - '.dll'
            - '.asp'
            - '.aspx'
            - '.jsp'
    condition: selection_parent and selection_path and selection_extension
level: high
falsepositives:
    - Legitimate configuration updates by Marvell support personnel
tags:
    - attack.t1190
    - attack.t1574

YARA Rule

rule Marvell_QConvergeConsole_CVE_2020_17389
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects strings and patterns associated with exploitation of decryptFile path traversal"
        cve = "CVE-2020-17389"
        date = "2025-01-01"
    strings:
        $s1 = "decryptFile" ascii wide
        $s2 = "GWTTestServiceImpl" ascii wide
        $s3 = "../" ascii wide
        $s4 = "C:\\Windows\\" ascii wide
        $s5 = "C:\\ProgramData\\" ascii wide
        $s6 = "C:\\inetpub\\" ascii wide
        $s7 = "Start Menu\\Startup" ascii wide
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Marvell QConvergeConsole decryptFile Arbitrary File Write (CVE-2020-17389)"; flow:established,to_server; content:"GWTTestServiceImpl"; http_uri; content:"decryptFile"; http_uri; content:"../"; http_uri; classtype:attempted-user; sid:202017389; rev:1; reference:cve,2020-17389;)

Elastic Detection

process where event.module == "sysmon" and event.action == "FileCreate" and
  process.parent.name == "java.exe" and
  (
    file.path : "*\\Windows\\Start Menu\\*" or
    file.path : "*\\inetpub\\*" or
    file.path : "*\\ProgramData\\*" or
    file.path : "*\\Users\\Public\\Scheduled Tasks\\*"
  ) and
  process.parent.executable : "*QConvergeConsole*"

Splunk SPL Query

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| search parent_process_name=java.exe OR parent_image="*\\java.exe"
| regex image=".*QConvergeConsole.*"
| regex target_filename="(\\\Windows\\\Start Menu\\\|\\\inetpub\\\|\\\ProgramData\\\|\\\Temp\\\\)"
| stats count by host, parent_process, target_filename, user
| where count > 5

Wazuh OSSEC Rule

<rule id="100389" level="12">
  <decoded_as>json</decoded_as>
  <field name="data.win.system.eventID">11</field>
  <field name="data.win.system.processName" regex="\.*java\.exe"))
  <field name="data.win.eventdata.targetFilename" regex="\\(Windows\\Start Menu\\|\inetpub\\|ProgramData\\\\)"
  <description>Marvell QConvergeConsole arbitrary file write attempt (CVE-2020-17389)</description>
  <group>sysmon_file_write,</group>
  <mitre><id>T1190</id></mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. As of this report, no vendor patch, security update, or version containing a fix has been identified from any tracked source. Marvell has not issued an advisory, and no release notes or changelogs reference CVE-2020-17389.

Given the absence of a formal patch, the following mitigations are recommended, in order of priority:

1. Immediate Mitigations

• Network segmentation: Move QConvergeConsole management interfaces to a dedicated management VLAN. Restrict access via firewall rules to only authorized administrative workstations (source IP allowlisting). Do not expose the console to the internet or to general corporate user subnets.
• Access control: Implement an application-layer reverse proxy (e.g., Nginx, Apache) in front of QConvergeConsole to enforce additional authentication (e.g., client certificates, MFA) and to filter requests containing path traversal indicators or access to the GWTTestServiceImpl RPC endpoint.
• Least-privilege service account: If the QConvergeConsole service runs as LocalSystem, reconfigure it to run under a least-privilege domain service account, limiting the impact of code execution from SYSTEM to a lower-privileged context.
• Disable unused services: If the GWT remote testing service is not required, disable it via the application's configuration (e.g., unload GWT test service modules).

2. Patch/Upgrade Steps

• Monitor Marvell's security advisory feed and contact Marvell support for a fix or mitigation script.
• Evaluate whether a newer version of QConvergeConsole exists, and if so, test and deploy it in a staging environment first. Note that as of this report, no known version addresses this CVE.
• If QConvergeConsole is no longer supported/end-of-life, consider migrating to Marvell's newer management platform (e.g., QConvergeConsole 7.x or a successor product) that does not include the affected GWT servlet.

3. Long-Term Hardening

• Implement a host-based intrusion prevention system (HIPS) or endpoint detection and response (EDR) solution with file integrity monitoring for critical system directories.
• Harden the Windows host: enable application whitelisting (e.g., AppLocker or WDAC) to block execution of unknown binaries written to writable locations.
• Clock and monitor for unusual file creation events using the Sigma/Elastic/Splunk rules above.
• Ensure backups of the management server are isolated from the network and tested regularly, given that a SYSTEM-level compromise could delete or encrypt everything.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2020-17389
2. Zero Day Initiative Advisory: https://www.zerodayinitiative.com/advisories/ZDI-20-976/ (related to ZDI-CAN-10502)
3. Marvell Product Page: https://www.marvell.com/products/storage-infrastructure.html (for confirming affected product scope)
4. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not listed; confirms no known in-the-wild exploitation as of this report date)

No threat actor campaigns or exploitation-in-the-wild evidence have been publicly reported for this CVE as of the report date. The EPSS score of 0.10086 places this vulnerability in the 95.2nd percentile of exploited CVEs, indicating that the absence of public exploits should not be taken as an absence of risk — the vulnerability class is well understood, and custom exploits are feasible for moderately skilled attackers.