CVE-2020-37020: SonarQube Privilege Escalation Flaw

CVE-2020-37020 Overview

CVE-2020-37020 is an unquoted service path vulnerability affecting SonarQube 8.3.1 on Windows. The flaw resides in the SonarQube service configuration, where the executable path containing spaces is not enclosed in quotation marks. A local attacker with limited privileges can place a malicious executable along the unquoted path. When the service starts or restarts, Windows executes the attacker-controlled binary with SYSTEM privileges. The weakness maps to CWE-428: Unquoted Search Path or Element.

Critical Impact
Local attackers can escalate to SYSTEM privileges by hijacking the SonarQube wrapper.exe service path during service restart.

Affected Products

SonarQube 8.3.1 (Windows installations)
SonarQube service running with wrapper.exe
Windows hosts where the service path contains unquoted spaces

Discovery Timeline

2026-01-29 - CVE-2020-37020 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2020-37020

Vulnerability Analysis

The vulnerability stems from an unquoted Windows service path in the SonarQube 8.3.1 installation. Windows Service Control Manager parses service binary paths from left to right, treating spaces as argument delimiters when the path is not quoted. When SonarQube installs its service, the ImagePath registry value points to wrapper.exe inside a directory tree that may contain spaces. Without surrounding quotes, Windows attempts to execute every space-delimited token as a potential binary. An attacker who can write to any intermediate directory along that path can plant a malicious executable with a matching filename.

Root Cause

The root cause is improper handling of the Windows service ImagePath registry entry. The SonarQube installer registers the service without wrapping the executable path in quotation marks. This violates Microsoft guidance for service installation and triggers Windows path-parsing behavior that searches each space-truncated segment. The defect is classified under CWE-428.

Attack Vector

Exploitation requires local access with permission to write to a directory in the unquoted service path. The attacker drops a malicious binary named to match the first space-truncated token, for example Program.exe in C:\. The attacker then waits for or triggers a service restart, typically through a system reboot. Windows launches the planted binary under the LocalSystem account, granting full host control. Public exploitation details are documented in Exploit-DB entry 48677 and the VulnCheck Advisory for SonarQube.

No verified exploit code is reproduced here. Refer to the linked advisories for the full proof-of-concept.

Detection Methods for CVE-2020-37020

Indicators of Compromise

Unexpected executable files placed at path segments such as C:\Program.exe or other space-truncated locations along the SonarQube install path
Service start events (Event ID 7036) followed by anomalous child processes spawned from the SonarQube service tree
New or modified files in directories preceding wrapper.exe in the service ImagePath
Unsigned binaries executing under NT AUTHORITY\SYSTEM adjacent to the SonarQube installation

Detection Strategies

Audit the Windows registry value HKLM\SYSTEM\CurrentControlSet\Services\SonarQube\ImagePath for unquoted paths containing spaces
Run wmic service get name,pathname,startmode and filter results for paths with spaces and no surrounding quotes
Monitor for service process creation where the parent is services.exe and the image path differs from the expected wrapper.exe
Alert on writes to root-level directories such as C:\ by non-administrative users

Monitoring Recommendations

Enable Windows Security and System event log forwarding for service installation and start events
Track filesystem changes in directories along service ImagePath values using file integrity monitoring
Correlate service restart events with new process creation under SYSTEM to surface hijack attempts

How to Mitigate CVE-2020-37020

Immediate Actions Required

Update the SonarQube service ImagePath registry entry to wrap the executable path in quotation marks
Restrict write permissions on C:\ and any directory along the service path to administrators only
Inventory all Windows services on SonarQube hosts and remediate any other unquoted paths discovered
Upgrade SonarQube to a version later than 8.3.1 where the installer registers the service with a quoted path

Patch Information

No vendor patch identifier is listed in the available CVE data. Administrators should consult the SonarQube Official Site for the latest supported release and review the VulnCheck Advisory for SonarQube for remediation guidance.

Workarounds

Manually edit the service ImagePath using sc config SonarQube binPath= "\"C:\Path With Spaces\wrapper.exe\"" to enforce quoting
Remove write and modify permissions for non-administrative users on every directory in the service path
Disable automatic service restart until the path is corrected to reduce the exploitation window

bash

# Configuration example: correct the unquoted service path
sc.exe config SonarQube binPath= "\"C:\Program Files\SonarQube\bin\windows-x86-64\wrapper.exe\""
icacls "C:\" /remove:g "Users"
icacls "C:\Program Files\SonarQube" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"