CVE-2020-35145
📋 TL;DR
CVE-2020-35145 is a local privilege escalation vulnerability in Acronis True Image for Windows, caused by DLL hijacking in multiple components. It allows attackers with local access to execute arbitrary code with elevated privileges. Users of Acronis True Image for Windows prior to Update 3 are affected.
💻 Affected Systems
- Acronis True Image for Windows
📦 What is this software?
True Image by Acronis
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control over the system, enabling data theft, malware installation, or system compromise.
Likely Case
Local users or malware escalate privileges to install persistent backdoors or bypass security controls.
If Mitigated
With proper access controls and patching, impact is limited to denial of service or minimal privilege abuse.
🎯 Exploit Status
Exploitation involves placing a malicious DLL in a specific path; public proof-of-concept code is available, making it accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021 Update 3 or later
Vendor Advisory: https://www.acronis.com/en-us/support/updates/changes.html?p=42246
Restart Required: Yes
Instructions:
1. Open Acronis True Image. 2. Go to Help > Check for Updates. 3. Install Update 3 or newer. 4. Restart the system as prompted.
🔧 Temporary Workarounds
Restrict DLL Search Path Permissions
windowsModify file permissions to prevent unauthorized DLL placement in vulnerable directories.
icacls "C:\Program Files\Acronis\TrueImage\" /deny Everyone:(OI)(CI)W
🧯 If You Can't Patch
- Remove or restrict local user access to vulnerable systems to reduce attack surface.
- Implement application whitelisting to block execution of unauthorized DLLs.
🔍 How to Verify
Check if Vulnerable:
Check the Acronis True Image version via Help > About; if version is earlier than 2021 Update 3, it is vulnerable.Check Version:
wmic product where name="Acronis True Image" get versionVerify Fix Applied:
After updating, confirm version is 2021 Update 3 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual DLL load events from Acronis processes in Windows Event Logs (e.g., Event ID 7).
Network Indicators:
- No direct network indicators, as this is a local exploit.
SIEM Query:
EventID=7 AND ProcessName LIKE "%Acronis%" AND DLLPath NOT LIKE "%Program Files%Acronis%"