Overview
This article details a critical security vulnerability, identified as CVE-2020-36879, affecting Flexsense DiskBoss version 11.7.28. This vulnerability allows unauthenticated attackers to elevate their privileges and execute arbitrary code with system-level privileges during startup or reboot. The root cause is an unquoted service path, which enables attackers to inject malicious commands.
Technical Details
The vulnerability lies in how DiskBoss’s services are configured. Specifically, the path to the service executable is not enclosed in quotes. This allows an attacker to insert malicious executables into directories along the service path. When the operating system attempts to start the service, it may inadvertently execute the attacker’s malicious code instead of the intended DiskBoss service executable. The attacker can leverage the sc qc command to identify the service name and then exploit the unquoted path. For instance, if the service path is C:\Program Files\DiskBoss\DiskBossService.exe, an attacker could create a malicious executable named Program.exe in the C:\ directory. Upon service startup, the system may execute C:\Program.exe Files\DiskBoss\DiskBossService.exe as the OS attempts to parse the unquoted path.
CVSS Analysis
While the provided information indicates that a CVSS score is not available (N/A), given the potential for unauthenticated remote code execution with elevated privileges, this vulnerability would likely score high to critical on the CVSS scale if formally scored. We expect a CVSS score of 9.0 or higher due to the possibility of remote, unauthenticated system compromise.
Possible Impact
The impact of this vulnerability is severe. A successful exploit allows an attacker to:
- Gain complete control of the affected system.
- Install malware, including ransomware or spyware.
- Steal sensitive data.
- Disrupt system operations.
- Use the compromised system as a launchpad for further attacks.
Mitigation or Patch Steps
Currently, there is no publicly available patch or official mitigation guidance from Flexsense for DiskBoss 11.7.28 related to this CVE. However, we strongly recommend the following:
- Contact Flexsense: Reach out to Flexsense support directly to inquire about a patch or workaround.
- Restrict Access: Implement strict access control measures to limit who can modify files within the DiskBoss installation directory and its parent directories.
- Monitor System Activity: Closely monitor system logs for suspicious activity, particularly related to service startup and process execution.
- Consider Alternatives: If feasible, consider using alternative solutions that do not exhibit this vulnerability.
- Upgrade if Possible: If a newer version of DiskBoss is available, evaluate it thoroughly for this vulnerability and other security improvements before upgrading.
- Workaround (Use with caution and test thoroughly): As a temporary workaround, you can manually edit the service configuration using the
sc configcommand to enclose the service path in quotes. For example:sc config "ServiceName" binPath= "\"C:\Program Files\DiskBoss\DiskBossService.exe\"". Replace “ServiceName” with the actual service name. Back up the system before implementing this workaround.
References
Flexsense DiskBoss Website
Flexsense DiskBoss Downloads
Exploit-DB Entry
VulnCheck Advisory
