CVE-2020-10143
📋 TL;DR
This vulnerability allows unprivileged Windows users to achieve arbitrary code execution with SYSTEM privileges by creating a specially-crafted openssl.cnf file in a predictable directory path. It affects Macrium Reflect installations that use the vulnerable OpenSSL component. Attackers can escalate privileges from a standard user account to full system control.
💻 Affected Systems
- Macrium Reflect
📦 What is this software?
Reflect by Macrium
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, credential theft, lateral movement, and data exfiltration.
Likely Case
Privilege escalation from standard user to SYSTEM, enabling attackers to bypass security controls and maintain persistence on compromised systems.
If Mitigated
Limited impact if proper access controls prevent unprivileged users from creating directories in system root paths.
🎯 Exploit Status
Exploitation requires local user access but is straightforward once access is obtained. The path traversal and file creation are simple operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.5285 and later
Vendor Advisory: https://knowledgebase.macrium.com/display/KNOW/Macrium+Reflect+Home+and+Server+7.3+Update+2
Restart Required: Yes
Instructions:
1. Download Macrium Reflect version 7.3.5285 or later from official vendor site. 2. Run the installer with administrative privileges. 3. Follow installation prompts. 4. Restart the system when prompted.
🔧 Temporary Workarounds
Restrict directory creation permissions
windowsPrevent unprivileged users from creating directories in C:\ root
icacls C:\ /deny "Users":(OI)(CI)W
icacls C:\ /deny "Authenticated Users":(OI)(CI)W
Remove vulnerable OpenSSL configuration
windowsRemove or secure the OpenSSL configuration directory
takeown /f C:\openssl /r /d y
icacls C:\openssl /remove "Users"
icacls C:\openssl /remove "Authenticated Users"
🧯 If You Can't Patch
- Implement strict access controls to prevent standard users from creating directories in system root paths
- Monitor for suspicious directory creation events in C:\openssl\ paths and investigate any unauthorized changes
🔍 How to Verify
Check if Vulnerable:
Check Macrium Reflect version: If version is earlier than 7.3.5285, system is vulnerable. Also check if C:\openssl\ directory exists and is writable by standard users.Check Version:
Check Macrium Reflect Help > About or examine installed programs in Control PanelVerify Fix Applied:
Verify Macrium Reflect version is 7.3.5285 or later. Confirm that standard users cannot create directories in C:\ root or write to C:\openssl\ if it exists.📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system access) for C:\openssl\ directory creation/modification
- Unexpected process creation with SYSTEM privileges from user accounts
- Creation of openssl.cnf file in C:\openssl\ by non-admin users
Network Indicators:
- Unusual outbound connections from SYSTEM processes
- Command and control traffic originating from privileged processes
SIEM Query:
EventID=4663 AND ObjectName LIKE 'C:\\openssl\\%' AND SubjectUserName NOT IN ('SYSTEM', 'Administrators')