CVE-2020-37028

Executive Summary

CVE-2020-37028 is a local stack-based buffer overflow vulnerability in Socusoft Photo to Video Converter Professional version 8.07. The flaw resides in the "Output Folder" input field, allowing an authenticated local attacker to craft a malicious payload that, when pasted into the field, overwrites the stack and can lead to arbitrary code execution. This vulnerability is unpatched and has a public proof-of-concept, making it a high-risk target for privilege escalation or lateral movement within a compromised host.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone desktop application vulnerability.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0, but based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): Low (L) – user-level access.
• User Interaction (UI): Required (R) – user must paste the payload.
• Scope (S): Unchanged (U) – exploitation stays within the same security authority.
• Confidentiality (C): High (H) – arbitrary code execution can read sensitive data.
• Integrity (I): High (H) – code execution can modify data.
• Availability (A): High (H) – code execution can crash or control the system.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Estimated Score: 7.3 (High)

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow. The "Output Folder" input field in Socusoft Photo to Video Converter Professional 8.07 does not properly validate the length of user-supplied data before copying it to a fixed-size stack buffer. When a user pastes a string longer than the allocated buffer, the excess data overwrites adjacent memory on the stack, including the saved return address and other critical data.

Attack Flow:

1. The attacker crafts a payload containing shellcode and a return address overwrite.
2. The payload is copied to the clipboard.
3. The victim (or attacker with local access) pastes the payload into the "Output Folder" field.
4. The application copies the payload into a stack buffer without bounds checking.
5. The overwritten return address redirects execution to the attacker's shellcode.
6. Shellcode executes with the privileges of the application (typically the current user).

Key Technical Details:

• Buffer Size: Unknown, but likely 256-512 bytes based on typical GUI input fields.
• Overwrite Offset: The exact offset to the return address must be determined via fuzzing (e.g., using a pattern like Aa0Aa1...).
• Shellcode: Must be position-independent and avoid null bytes if the copy function is strcpy-like.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the production binary of version 8.07. A patched version would include bounds checking, such as:

Vulnerable (pseudocode):

char buffer[256];
strcpy(buffer, user_input); // No length check

Patched (pseudocode):

char buffer[256];
strncpy(buffer, user_input, sizeof(buffer) - 1);
buffer[sizeof(buffer) - 1] = '\0';

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Windows 10/11 VM (x86 or x64)
• Socusoft Photo to Video Converter Professional 8.07 installed
• Immunity Debugger or x64dbg for analysis
• Python 3 with pwntools for payload generation

Exploit Steps:

1. Fuzz the buffer: Use a pattern to find the exact offset to the return address.

   from pwn import *
   pattern = cyclic(1000)
   print(pattern)
   

2. Determine offset: After crash, use !mona findmsp or cyclic_find to get offset.
3. Craft payload:

   from pwn import *
   offset = 512  # Example offset
   shellcode = asm(shellcraft.sh())  # Or use msfvenom
   payload = b"A" * offset + p32(0xdeadbeef) + b"\x90" * 16 + shellcode
   

4. Deliver payload: Copy payload to clipboard and paste into the "Output Folder" field.
5. Trigger: Click "OK" or "Convert" to trigger the overflow.

Note: The exact offset and return address must be determined dynamically. Use !mona jmp esp to find a suitable JMP ESP gadget for reliable exploitation.

Blue Team (Defense)

Detection:

• Monitor for unusually long strings pasted into the application's input fields.
• Use Application Control (e.g., AppLocker) to block execution of unknown binaries.
• Enable Windows Defender Exploit Guard (CFG, DEP, ASLR).

Mitigation:

• Restrict local user privileges to prevent exploitation.
• Use a sandbox or virtualized environment for running legacy software.
• Apply a custom patch using API hooking (e.g., Detours) to add bounds checking to the vulnerable function.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • SocusoftPhotoToVideoConverter.exe (version 8.07): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder)
• Network: No network IOCs (local exploitation).
• Process: SocusoftPhotoToVideoConverter.exe crashing with exception code 0xC0000005 (access violation).
• Registry: Potential persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run if shellcode installs a backdoor.

Detection Engineering

YARA Rule

rule CVE_2020_37028_Socusoft_BOF {
    meta:
        description = "Detects Socusoft Photo to Video Converter 8.07 binary with buffer overflow vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "Output Folder" wide ascii
        $s2 = "Socusoft Photo to Video Converter" wide ascii
        $s3 = "8.07" wide ascii
    condition:
        all of them
}

Sigma Rule

title: Socusoft Photo to Video Converter Buffer Overflow Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2020-37028 via long input in Output Folder field
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: windows
detection:
    selection:
        EventID: 1000  # Application Error
        Image|endswith: '\SocusoftPhotoToVideoConverter.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-37028 Socusoft BOF Exploit Attempt"; flow:to_server; content:"|41 41 41 41|"; depth:512; classtype:attempted-user; sid:1000001; rev:1;)

Note: This rule is a placeholder; actual exploitation is local, not network-based.

Remediation & Mitigation

1. Immediate: Uninstall Socusoft Photo to Video Converter Professional 8.07 and replace with an alternative tool.
2. Short-term: If removal is not possible, restrict execution via AppLocker or Software Restriction Policies to only trusted users.
3. Long-term: Monitor the vendor for a patch. Since the vendor has not released a fix, consider using a virtualized environment (e.g., Sandboxie) to run the application.
4. Compensating Controls: Enable DEP, ASLR, and CFG system-wide. Use EMET (Enhanced Mitigation Experience Toolkit) if available.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated: 2025-04-10