CVE-2020-24567
📋 TL;DR
CVE-2020-24567 is a privilege escalation vulnerability in voidtools Everything search software. Attackers can place a malicious urlmon.dll file in the installation directory to execute arbitrary code with elevated privileges. This primarily affects systems where low-privileged users have write access to the Everything installation directory.
💻 Affected Systems
- voidtools Everything
📦 What is this software?
Everything by Voidtools
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where an attacker gains SYSTEM/administrator privileges, enabling complete control over the affected system, data theft, and lateral movement.
Likely Case
Local privilege escalation allowing a standard user to gain administrative privileges on the system where Everything is installed.
If Mitigated
No impact if proper access controls prevent low-privileged users from writing to the Everything installation directory.
🎯 Exploit Status
Exploitation requires local access and ability to write to the installation directory. The technique involves DLL hijacking which is well-understood and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1 Beta Nightly 2020-08-18 and later
Vendor Advisory: https://www.voidtools.com/forum/viewtopic.php?p=32509#p32509
Restart Required: Yes
Instructions:
1. Download latest version from voidtools.com. 2. Uninstall current version. 3. Install updated version. 4. Restart system to ensure clean state.
🔧 Temporary Workarounds
Restrict installation directory permissions
windowsRemove write permissions for low-privileged users from the Everything installation directory
icacls "C:\Program Files\Everything" /deny Users:(OI)(CI)W
icacls "C:\Program Files (x86)\Everything" /deny Users:(OI)(CI)W
Run Everything with standard user privileges
windowsConfigure Everything to run without administrative privileges to limit impact
🧯 If You Can't Patch
- Remove write permissions for all non-administrative users from the Everything installation directory
- Uninstall Everything from systems where it's not essential for operations
🔍 How to Verify
Check if Vulnerable:
Check Everything version via Help → About. If version is earlier than 1.4.1 Beta Nightly 2020-08-18, system is vulnerable if low-privileged users can write to installation directory.Check Version:
"C:\Program Files\Everything\Everything.exe" -versionVerify Fix Applied:
Verify version is 1.4.1 Beta Nightly 2020-08-18 or later in Help → About. Check installation directory permissions to ensure only administrators have write access.📡 Detection & Monitoring
Log Indicators:
- File creation events for urlmon.dll in Everything installation directory
- Process creation events for Everything.exe with unexpected parent processes
Network Indicators:
- Unusual outbound connections from Everything.exe process
SIEM Query:
EventID=11 OR EventID=4688 | where (TargetFilename contains "Everything\\urlmon.dll" OR NewProcessName contains "Everything.exe")