CVE-2020-36168
📋 TL;DR
This vulnerability allows low-privileged Windows users to achieve SYSTEM-level arbitrary code execution by planting a malicious OpenSSL configuration file. It affects Veritas Resiliency Platform 3.4 and 3.5 installations using the Managed Host addon on Windows systems. Attackers can gain complete administrative control over affected systems.
💻 Affected Systems
- Veritas Resiliency Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM-level compromise allowing complete control of the server, data exfiltration, lateral movement, and persistence establishment.
Likely Case
Local privilege escalation from low-privileged user to SYSTEM, enabling attacker to access all data and applications on the compromised host.
If Mitigated
Limited impact if proper file permissions prevent low-privileged users from creating directories/files in C:\usr\local\ssl\.
🎯 Exploit Status
Exploitation requires local access and ability to create files/directories in C:\usr\local\ssl\. The vulnerability is well-documented with clear exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 3.5.1 or later
Vendor Advisory: https://www.veritas.com/content/support/en_US/security/VTS20-015
Restart Required: Yes
Instructions:
1. Download the latest patch from Veritas support portal. 2. Apply the patch following Veritas documentation. 3. Restart the Resiliency Platform services.
🔧 Temporary Workarounds
Restrict directory permissions
windowsPrevent low-privileged users from creating files in the vulnerable directory path
icacls C:\usr /deny Users:(OI)(CI)F
icacls C:\usr\local /deny Users:(OI)(CI)F
icacls C:\usr\local\ssl /deny Users:(OI)(CI)F
🧯 If You Can't Patch
- Implement strict file system permissions to prevent low-privileged users from creating directories/files in C:\usr\local\ssl\
- Monitor for creation of openssl.cnf files in C:\usr\local\ssl\ and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if Veritas Resiliency Platform 3.4 or 3.5 is installed with Managed Host addon on Windows, and verify if C:\usr\local\ssl\ directory exists or is writable by low-privileged users.Check Version:
Check Veritas Resiliency Platform console or installation directory for version informationVerify Fix Applied:
Verify version is 3.5.1 or later, and test that low-privileged users cannot create files in C:\usr\local\ssl\openssl.cnf.📡 Detection & Monitoring
Log Indicators:
- Creation of openssl.cnf file in C:\usr\local\ssl\
- Unexpected service restarts of Veritas Resiliency Platform
- OpenSSL library loading errors
Network Indicators:
- Unusual outbound connections from Veritas Resiliency Platform server
- Lateral movement attempts from the compromised host
SIEM Query:
EventID=4663 OR EventID=4656 AND ObjectName LIKE '%C:\\usr\\local\\ssl\\openssl.cnf%'