CVE-2020-9452
📋 TL;DR
This vulnerability in Acronis True Image 2020 allows unprivileged users to escalate privileges to SYSTEM by exploiting improper access controls in the anti-ransomware quarantine feature. Attackers can write arbitrary files to any location on the system using hardlink manipulation. Users of Acronis True Image 2020 with the anti-ransomware service enabled are affected.
💻 Affected Systems
- Acronis True Image 2020
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege escalation leading to complete system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install malware, or access sensitive system resources.
If Mitigated
Limited impact if anti-ransomware service is disabled or proper access controls are implemented on quarantine directories.
🎯 Exploit Status
Exploitation requires local user access and knowledge of the REST API endpoint. The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.5.22510 hotfix or later versions
Vendor Advisory: https://www.acronis.com
Restart Required: Yes
Instructions:
1. Open Acronis True Image 2020. 2. Check for updates in settings. 3. Install available updates. 4. Restart the system to ensure changes take effect.
🔧 Temporary Workarounds
Disable Anti-Ransomware Service
windowsTemporarily disable the vulnerable anti-ransomware service until patching is possible.
sc stop "Acronis Active Protection Service"
sc config "Acronis Active Protection Service" start= disabled
Restrict Quarantine Folder Permissions
windowsModify permissions on the quarantine folder to prevent unprivileged write access.
icacls "C:\ProgramData\Acronis\TrueImageHome\Quarantine" /inheritance:r /grant SYSTEM:F /grant Administrators:F
🧯 If You Can't Patch
- Disable the anti-ransomware feature entirely through Acronis True Image settings
- Implement strict access controls and monitoring for local user activities on affected systems
🔍 How to Verify
Check if Vulnerable:
Check Acronis True Image version in Help > About. If version is 24.5.22510 or earlier, the system may be vulnerable.Check Version:
wmic product where "name like 'Acronis True Image%'" get versionVerify Fix Applied:
Verify Acronis True Image version is updated beyond 24.5.22510 and test that anti-ransomware service functions without allowing unauthorized file writes.📡 Detection & Monitoring
Log Indicators:
- Unusual file operations in Acronis quarantine directories
- Multiple failed or suspicious REST API calls to anti_ransomware_service.exe
- Unexpected privilege escalation events in Windows security logs
Network Indicators:
- Local REST API calls to anti-ransomware service on non-standard ports
- Unusual process creation from Acronis services
SIEM Query:
EventID=4688 AND (NewProcessName LIKE '%anti_ransomware_service.exe%' OR ParentProcessName LIKE '%anti_ransomware_service.exe%')