CVE-2020-27383
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in the Battle.net launcher where authenticated users can replace the Battle.net.exe file with malicious code. The vulnerability exists because the executable file grants 'Full Control' permissions to the 'Authenticated Users' group. Any Windows system running the vulnerable Battle.net launcher with standard user accounts is affected.
💻 Affected Systems
- Battle.net Launcher
📦 What is this software?
Battle.net by Blizzard
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could replace Battle.net.exe with malware that runs with elevated privileges, potentially gaining full system control, installing persistent backdoors, or accessing sensitive data.
Likely Case
Malicious users on shared systems could escalate privileges to install unauthorized software, modify system settings, or access other users' data.
If Mitigated
With proper file permissions and user account controls, impact is limited to the user's own account scope without privilege escalation.
🎯 Exploit Status
Exploitation requires authenticated user access and involves simple file replacement operations. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions of Battle.net launcher (check for updates)
Vendor Advisory: Not publicly documented by Blizzard
Restart Required: Yes
Instructions:
1. Open Battle.net launcher 2. Click on Battle.net menu 3. Select 'Check for Updates' 4. Apply any available updates 5. Restart the launcher
🔧 Temporary Workarounds
Modify File Permissions
windowsRemove 'Full Control' permissions for Authenticated Users group on Battle.net.exe
icacls "C:\Program Files (x86)\Battle.net\Battle.net.exe" /remove "Authenticated Users"
Restrict User Access
windowsLimit Battle.net installation to trusted user accounts only
🧯 If You Can't Patch
- Remove 'Authenticated Users' group permissions from Battle.net.exe file
- Restrict Battle.net installation to systems where all users are fully trusted
🔍 How to Verify
Check if Vulnerable:
Check Battle.net.exe file permissions: icacls "C:\Program Files (x86)\Battle.net\Battle.net.exe" and look for 'Authenticated Users:(F)'Check Version:
Check Battle.net launcher version in Settings > About or examine file propertiesVerify Fix Applied:
Verify Authenticated Users group no longer has Full Control permissions on Battle.net.exe📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system access) for Battle.net.exe modifications
- Unexpected process creation from Battle.net.exe location
Network Indicators:
- Unusual network connections originating from Battle.net.exe process
SIEM Query:
EventID=4663 AND ObjectName="*Battle.net.exe" AND AccessMask=0x1F01FF