CVE-2020-15351
📋 TL;DR
This vulnerability allows any authenticated Windows user to escalate privileges to SYSTEM level by replacing the IDriveService binary with a malicious one. The default installation sets weak folder permissions, enabling modification of program files. All Windows systems running vulnerable IDrive versions are affected.
💻 Affected Systems
- IDrive for Windows
📦 What is this software?
Idrive by Idrive
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, credential theft, and full control over the affected system.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, or access sensitive system resources.
If Mitigated
Limited impact if proper access controls are enforced and service binaries are protected from modification.
🎯 Exploit Status
Exploitation requires authenticated user access but is straightforward - simply replace the service binary with a malicious one.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.7.3.19 and later
Vendor Advisory: https://www.idrive.com/release-info#win
Restart Required: Yes
Instructions:
1. Download latest IDrive version from official website. 2. Run installer to update. 3. Restart system to ensure service updates take effect.
🔧 Temporary Workarounds
Restrict folder permissions
windowsModify NTFS permissions on IDrive installation folder to remove modify access for authenticated users
icacls "%PROGRAMFILES(X86)%\IDriveWindows" /remove "NT AUTHORITY\Authenticated Users" /T
Disable IDriveService
windowsTemporarily disable the vulnerable service if IDrive functionality is not required
sc config IDriveService start= disabled
sc stop IDriveService
🧯 If You Can't Patch
- Apply strict folder permissions to prevent unauthorized modifications to IDrive directory
- Monitor for unauthorized service binary modifications using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check folder permissions: icacls "%PROGRAMFILES(X86)%\IDriveWindows" | findstr "Authenticated Users"Check Version:
Check IDrive about dialog or registry: reg query "HKLM\SOFTWARE\IDrive" /v VersionVerify Fix Applied:
Verify version is 6.7.3.19+ and folder permissions no longer grant modify to Authenticated Users📡 Detection & Monitoring
Log Indicators:
- Windows Event ID 4688 (process creation) showing IDriveService spawning unexpected processes
- Event ID 4663 (file system access) showing modifications to IDrive binaries
Network Indicators:
- Unusual outbound connections from SYSTEM-level processes
SIEM Query:
source="windows" (event_id=4688 AND process_name="IDriveService.exe" AND parent_process_name!="services.exe") OR (event_id=4663 AND object_name="*IDriveWindows*" AND access_mask="0x2")