CVE-2023-37537
📋 TL;DR
This vulnerability allows a local attacker to gain elevated privileges on Windows systems running HCL AppScan Presence service. Attackers can exploit an unquoted service path to execute arbitrary code with SYSTEM privileges. Only organizations using HCL AppScan on Cloud (ASoC) with the vulnerable Windows service are affected.
💻 Affected Systems
- HCL AppScan on Cloud (ASoC)
- HCL AppScan Presence
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full SYSTEM privileges, enabling complete compromise of the Windows host, lateral movement, and persistence.
Likely Case
Local attacker escalates privileges to install malware, steal credentials, or access sensitive data on the compromised system.
If Mitigated
With proper access controls and monitoring, impact is limited to the specific service account and can be detected quickly.
🎯 Exploit Status
Requires local access to the Windows system. Unquoted service path vulnerabilities are well-understood and relatively easy to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to HCL advisory for specific patched versions
Vendor Advisory: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108018
Restart Required: Yes
Instructions:
1. Review HCL advisory KB0108018. 2. Download and apply the latest patch from HCL. 3. Restart the AppScan Presence service. 4. Verify the service path is now properly quoted.
🔧 Temporary Workarounds
Quote Service Path Manually
windowsManually edit the service path to include quotes around the executable path
sc config "ServiceName" binPath= "\"C:\Path\To\Executable.exe\"" arguments
Restrict Write Permissions
windowsRemove write permissions from directories in the unquoted service path
icacls "C:\Path\To\Directory" /deny Everyone:(OI)(CI)W
🧯 If You Can't Patch
- Apply workaround to quote the service path manually
- Implement strict access controls and monitoring on affected systems
🔍 How to Verify
Check if Vulnerable:
Check if AppScan Presence service path is unquoted: sc qc "AppScan Presence" | findstr BINARY_PATH_NAMECheck Version:
Check installed version through HCL AppScan interface or Windows Programs and FeaturesVerify Fix Applied:
Verify service path now has quotes: sc qc "AppScan Presence" | findstr BINARY_PATH_NAME📡 Detection & Monitoring
Log Indicators:
- Unexpected service restarts
- Unauthorized file creation in service directories
- Privilege escalation events
Network Indicators:
- Unusual outbound connections from service account
SIEM Query:
EventID=4688 AND NewProcessName contains spaces AND ParentProcessName contains services.exe