CVE-2020-36880

Executive Summary

CVE-2020-36880 is a local buffer overflow vulnerability identified in Flexsense DiskBoss version 7.7.14. The flaw resides in the "Reports and Data Directory" field, allowing an authenticated attacker to execute arbitrary code on the affected system. With a CVSS score of 0.0 (likely unassigned or placeholder), the risk is elevated due to the potential for full system compromise. No public exploit code or patch is currently available, making this a high-priority issue for organizations using DiskBoss.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone application vulnerability in Flexsense DiskBoss.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although local access is required, successful exploitation leads to arbitrary code execution with the privileges of the DiskBoss service, potentially SYSTEM level.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121) in the "Reports and Data Directory" configuration field. When DiskBoss processes a specially crafted string for this directory path, it fails to perform proper bounds checking before copying the data into a fixed-size stack buffer. An attacker can overwrite the return address and other critical stack data, redirecting execution to attacker-controlled shellcode.

Attack Vector:

1. Attacker gains local access to the system (e.g., via compromised user account or malware).
2. Attacker modifies the DiskBoss configuration file or uses the application's GUI to set the "Reports and Data Directory" to an overly long string containing shellcode and a return address.
3. Upon restart or when DiskBoss processes the directory path, the overflow triggers, executing the shellcode.

Vulnerable vs. Patched Code

Vulnerable Code (DiskBoss 7.7.14):

void SetReportsDirectory(char *userInput) {
    char buffer[256];
    strcpy(buffer, userInput); // No bounds checking
    // ... rest of function
}

Patched Code (Hypothetical):

void SetReportsDirectory(char *userInput) {
    char buffer[256];
    strncpy(buffer, userInput, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... rest of function
}

The vulnerable code uses strcpy which does not limit the number of bytes copied, leading to overflow. A patched version would use strncpy or similar safe functions.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Windows 10/11 VM with DiskBoss 7.7.14 installed.
• Debugger (x64dbg) and Python for payload generation.

Exploit Steps:

1. Identify the offset to the return address using a pattern (e.g., cyclic from Metasploit).
2. Generate shellcode (e.g., reverse shell) using msfvenom.
3. Craft payload: [JUNK_DATA] + [RETURN_ADDRESS] + [NOP_SLED] + [SHELLCODE].
4. Set the "Reports and Data Directory" to the payload via the GUI or config file.
5. Restart DiskBoss service or trigger the vulnerable function.

Example Payload Construction (Python):

import struct

offset = 260  # Example offset
junk = b"A" * offset
ret_addr = struct.pack("<I", 0x12345678)  # Address of a "jmp esp" gadget
nop_sled = b"\x90" * 16
shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

payload = junk + ret_addr + nop_sled + shellcode
print(payload)

Blue Team

Detection:

• Monitor for DiskBoss process crashes or abnormal terminations.
• Look for unusually long strings in DiskBoss configuration files (e.g., DiskBoss.ini).
• Use Sysmon to detect process creation from DiskBoss with suspicious command-line arguments.

Hunting:

• Search for Event ID 1000 (Application Error) in Windows Event Logs related to DiskBoss.exe.
• Check for memory corruption indicators in DiskBoss logs.

Indicators of Compromise (IOCs)

• File Hashes:
  • DiskBoss.exe (v7.7.14): SHA256 [UNKNOWN]
• Registry Keys:
  • HKLM\SOFTWARE\Flexsense\DiskBoss\Settings\ReportsDirectory (modified with malicious payload)
• Network:
  • Outbound connections from DiskBoss process to unknown IPs (if reverse shell used)
• Process:
  • DiskBoss.exe spawning cmd.exe or powershell.exe

Detection Engineering

YARA Rule

rule CVE_2020_36880_DiskBoss_BOF {
    meta:
        description = "Detects potential buffer overflow payload in DiskBoss configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36880"
    strings:
        $s1 = "ReportsDirectory" ascii wide nocase
        $s2 = { 41 41 41 41 41 41 41 41 } // Pattern of 'A's (junk data)
        $s3 = { 90 90 90 90 90 90 90 90 } // NOP sled
    condition:
        $s1 and ( #s2 > 100 or #s3 > 10 )
}

Sigma Rule

title: DiskBoss Buffer Overflow Attempt
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects attempts to exploit CVE-2020-36880 via long input in ReportsDirectory
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Application: 'DiskBoss.exe'
        FaultingModule: 'DiskBoss.exe'
    condition: selection
falsepositives:
    - Legitimate long directory paths (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-36880 DiskBoss Potential Reverse Shell"; flow:to_server,established; content:"|31 c0 50 68 2f 2f 73 68|"; fast_pattern; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict local access to systems running DiskBoss 7.7.14. Use least privilege principles.
2. Short-term: Monitor for any abnormal DiskBoss behavior. Implement application whitelisting to prevent unauthorized code execution.
3. Long-term: Contact Flexsense for an official patch. If unavailable, consider migrating to an alternative disk management tool.
4. Compensating Controls: Enable Windows Defender Exploit Guard (e.g., Control Flow Guard, Data Execution Prevention) to mitigate exploitation.

Valters IT