CVE-2020-36989: ForensiT AppX Privilege Escalation Flaw

CVE-2020-36989 Overview

CVE-2020-36989 affects ForensiT AppX Management Service version 2.2.0.4. The service registers an unquoted executable path in its Windows service configuration. Local authenticated attackers can place a malicious binary along the search path. Windows then executes the attacker-controlled binary under the LocalSystem account when the service starts. The flaw is classified under CWE-428: Unquoted Search Path or Element.

Critical Impact
Successful exploitation grants LocalSystem privileges on the affected host, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

ForensiT AppX Management Service 2.2.0.4
ForensitAppXService.exe Windows service binary
Systems where the service is installed under a path containing spaces

Discovery Timeline

2026-01-28 - CVE-2020-36989 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-36989

Vulnerability Analysis

The ForensiT AppX Management Service installs ForensitAppXService.exe and registers its executable path in the Windows Service Control Manager (SCM) without surrounding quotation marks. When a service path contains spaces and is not quoted, Windows attempts to load each whitespace-delimited token as an executable in order. An attacker with write access to any intermediate directory can drop a malicious executable that Windows loads instead of the intended binary.

The service runs in the LocalSystem security context. Code executed during service startup inherits these privileges. This converts a local low-privileged user account into full system control after a reboot or service restart.

Root Cause

The root cause is improper service registration. The vendor wrote the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\ without enclosing the path in double quotes. Windows resolves unquoted paths by treating spaces as token separators. This well-documented Windows behavior is the basis for [CWE-428].

Attack Vector

Exploitation requires local access and the ability to write a file to a directory that appears earlier in the unquoted path than the legitimate binary. The attacker plants a payload matching the truncated token name with an .exe extension. When the service starts — manually, on reboot, or through scheduled triggers — the SCM launches the planted binary as LocalSystem. No user interaction is required after planting. Public exploitation details are available at Exploit-DB entry 48821 and the VulnCheck advisory.

The vulnerability manifests through Windows service configuration rather than code logic. There is no source-level patch to display. See the referenced advisories for technical details.

Detection Methods for CVE-2020-36989

Indicators of Compromise

Unexpected executables in directories that appear as prefixes of the ForensiT AppX Management Service ImagePath
New files such as Program.exe or Forensit.exe in C:\ or C:\Program Files\ written by non-administrative accounts
Process creation events showing ForensitAppXService or services.exe spawning binaries from non-standard locations
Service start events (Event ID 7036) followed by anomalous LocalSystem process activity

Detection Strategies

Enumerate Windows services and flag any ImagePath value containing spaces without enclosing quotes using wmic service get name,pathname,startmode
Audit Windows Security Event Log for Event ID 4688 (process creation) where the parent is services.exe and the image path is unexpected
Monitor file write operations to root drives and Program Files directories from non-administrative principals
Correlate service installation or modification events with subsequent privileged process execution

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 11 (file create) to capture binary plant attempts
Forward Windows service configuration changes (Event ID 7045) to a centralized SIEM for review
Establish baselines for service paths and alert on drift, especially new unquoted entries
Review directory access control lists (ACLs) on path prefixes to identify writable locations exposed to standard users

How to Mitigate CVE-2020-36989

Immediate Actions Required

Inventory all hosts running ForensiT AppX Management Service 2.2.0.4 and identify those with unquoted service paths
Quote the ImagePath value for the affected service in the registry to remove the parsing ambiguity
Restrict write permissions on root drives and Program Files prefixes so standard users cannot plant executables
Restart affected services after applying the registry change to validate the corrected path

Patch Information

Review the ForensiT downloads page for an updated release that registers the service with a properly quoted path. Verify after installation that the ImagePath registry value is enclosed in double quotes.

Workarounds

Manually correct the registry value at HKLM\SYSTEM\CurrentControlSet\Services\ForensitAppXService\ImagePath to wrap the executable path in quotes
Remove Write and Modify permissions for non-administrative users on C:\ and any directory along the unquoted path
Disable the service if it is not required for operational purposes
Apply application allowlisting to block execution of unsigned binaries from non-standard locations

bash

# Configuration example — correct an unquoted service path on Windows
# Run from an elevated PowerShell session

$svc = 'ForensitAppXService'
$current = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc").ImagePath
Write-Host "Current ImagePath: $current"

# Wrap the binary path in double quotes
$fixed = '"C:\Program Files\ForensiT\AppX Management\ForensitAppXService.exe"'
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\$svc" -Name ImagePath -Value $fixed

Restart-Service -Name $svc