CVE-2020-36162
📋 TL;DR
This vulnerability allows low-privileged Windows users to achieve arbitrary code execution with administrator privileges in Veritas CloudPoint. By creating a malicious OpenSSL configuration file at a predictable location, attackers can load a malicious engine and gain full system control. This affects Veritas CloudPoint Windows Agent installations before version 8.3.0.1+hotfix.
💻 Affected Systems
- Veritas CloudPoint Windows Agent
📦 What is this software?
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
Cloudpoint by Veritas
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrator privileges, allowing data theft, application access, and persistent backdoor installation.
Likely Case
Privilege escalation from low-privileged user to SYSTEM/administrator level, enabling lateral movement and data exfiltration.
If Mitigated
Limited impact if proper access controls prevent low-privileged users from creating files in root directories.
🎯 Exploit Status
Exploitation requires local access and ability to create files at specific path. The technique is well-documented for OpenSSL configuration hijacking.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.0.1+hotfix
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS20-011
Restart Required: Yes
Instructions:
1. Download patch from Veritas support portal. 2. Stop CloudPoint services. 3. Apply the hotfix. 4. Restart services and verify functionality.
🔧 Temporary Workarounds
Restrict directory creation permissions
windowsPrevent low-privileged users from creating directories at root level of drives
icacls C:\ /deny "Users":(OI)(CI)W
icacls D:\ /deny "Users":(OI)(CI)W
Create dummy configuration file
windowsCreate the expected openssl.cnf file with secure permissions to prevent hijacking
mkdir C:\usr\local\ssl
echo # Secure config > C:\usr\local\ssl\openssl.cnf
icacls C:\usr\local\ssl\openssl.cnf /inheritance:r /grant "SYSTEM":F /grant "Administrators":F
🧯 If You Can't Patch
- Implement strict access controls preventing low-privileged users from creating files/directories at root of drives
- Monitor for creation of openssl.cnf files in unexpected locations and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check CloudPoint Agent version via Control Panel > Programs and Features, or run 'wmic product where name="Veritas CloudPoint Agent" get version'Check Version:
wmic product where name="Veritas CloudPoint Agent" get versionVerify Fix Applied:
Verify version is 8.3.0.1 or later, and check that C:\usr\local\ssl\openssl.cnf either doesn't exist or has secure permissions📡 Detection & Monitoring
Log Indicators:
- File creation events at C:\usr\local\ssl\openssl.cnf by non-admin users
- Process creation from CloudPoint agent loading unexpected DLLs
Network Indicators:
- Unusual outbound connections from CloudPoint agent processes
SIEM Query:
EventID=4663 OR EventID=4656 AND ObjectName="*openssl.cnf" AND SubjectUserName NOT IN ("SYSTEM", "Administrator*")