CVE-2020-36983: Quick 'n Easy FTP Privilege Escalation

CVE-2020-36983 Overview

CVE-2020-36983 is an unquoted service path vulnerability affecting Quick 'n Easy FTP Service 3.2, a Windows FTP server application developed by Pablo Software Solutions. This local privilege escalation vulnerability allows attackers with local system access to execute arbitrary code with elevated LocalSystem privileges by exploiting an improperly quoted service binary path during service startup or system boot.

When Windows services are registered with paths containing spaces and lacking proper quotation marks, the operating system attempts to parse the path by searching for executables at each potential break point in the path. This allows attackers to plant malicious executables in predictable locations that will be executed with the service's configured privileges.

Critical Impact

Local attackers can achieve LocalSystem privilege escalation by placing malicious executables in the service path, enabling complete system compromise during service restart or system boot.

Affected Products

• Quick 'n Easy FTP Service 3.2
• Earlier versions of Quick 'n Easy FTP Service may also be affected

Discovery Timeline

• 2026-01-27 - CVE CVE-2020-36983 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2020-36983

Vulnerability Analysis

The vulnerability exists due to improper configuration of the Windows service registration for Quick 'n Easy FTP Service. When the service is installed, the binary path is stored in the Windows registry without enclosing quotation marks. This configuration issue maps to CWE-428 (Unquoted Search Path or Element).

The root cause lies in how Windows handles service paths containing spaces. When a service path like C:\Program Files\Quick n Easy FTP Service\service.exe is registered without quotes, Windows interprets it as multiple potential executable locations. The system first searches for C:\Program.exe, then C:\Program Files\Quick.exe, and continues parsing until it finds a valid executable or reaches the intended path.

This vulnerability requires local access to the system and the ability to write files to locations within the service path hierarchy. Successful exploitation results in arbitrary code execution with LocalSystem privileges, the highest privilege level on Windows systems.

Root Cause

The vulnerability stems from the service installer failing to properly quote the ImagePath registry value when registering the Windows service. The service configuration stores an unquoted path in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ registry key, creating a parsing ambiguity that Windows exploits sequentially.

Attack Vector

Exploitation requires local access with write permissions to a directory within the unquoted service path. An attacker can create a malicious executable at one of the intermediate path locations that Windows will attempt to execute. When the service starts (either manually, at boot time, or after a system crash), Windows will execute the attacker's malicious payload with LocalSystem privileges instead of or before the legitimate service binary.

The attack surface is limited to local users who can write to directories like C:\Program Files\ or create directories at the root of the system drive. However, in environments with misconfigured permissions or where multiple users share systems, this vulnerability presents a reliable privilege escalation vector.

Detection Methods for CVE-2020-36983

Indicators of Compromise

• Unexpected executable files in root directories or C:\Program Files\ with names matching path components (e.g., Program.exe, Quick.exe)
• Service failures or unexpected process execution during system startup
• New or suspicious files created in directories along the service installation path
• Unusual processes running with LocalSystem privileges at boot time

Detection Strategies

• Query Windows services for unquoted paths using PowerShell: Get-WmiObject Win32_Service | Where-Object { $_.PathName -notlike '"*' -and $_.PathName -like '* *' }
• Monitor file creation events in C:\ and C:\Program Files\ directories for suspicious executables
• Review Windows Event Logs for service control manager events indicating service execution failures or unexpected binary paths
• Implement file integrity monitoring on directories commonly targeted by unquoted service path attacks

Monitoring Recommendations

• Enable Windows audit policies for object access to track file creation in system directories
• Configure endpoint detection rules to alert on executable file creation in path segments of known vulnerable services
• Regularly audit installed services for unquoted path configurations as part of system hardening assessments
• Monitor for abnormal service behavior including unexpected restarts or failures

How to Mitigate CVE-2020-36983

Immediate Actions Required

• Audit the Quick 'n Easy FTP Service installation to verify the current path configuration in the Windows registry
• Manually correct the unquoted service path by adding quotation marks to the ImagePath registry value
• Review directory permissions to ensure standard users cannot write to directories in the service path hierarchy
• Consider uninstalling the vulnerable software if it is no longer needed or actively maintained

Patch Information

As of the last NVD update, no official vendor patch has been released for this vulnerability. Administrators should refer to the Pablo Software Solutions website for any future updates. The VulnCheck Advisory provides additional technical details and mitigation guidance. Historical exploit details are documented on Exploit-DB #48983.

Workarounds

• Manually fix the service path by adding quotation marks to the registry entry: Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[ServiceName] and modify the ImagePath value to include quotes around the full path
• Restrict write permissions on directories that fall within the unquoted path segments to prevent malicious file placement
• Implement application whitelisting to prevent execution of unauthorized executables in system directories
• Consider migrating to an alternative FTP server solution that is actively maintained and patched

# Registry fix example (run as Administrator in Command Prompt)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\QuickNEasyFTP" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Quick n Easy FTP Service\service.exe\"" /f