CVE-2020-37160: SprintWork Privilege Escalation Flaw

CVE-2020-37160 Overview

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

Critical Impact

Local attackers with low privileges can escalate to full administrative access on affected Windows systems, potentially compromising the entire host and any data stored on it.

Affected Products

• SprintWork 2.3.1
• SprintWork 2.x versions (potentially affected)
• Windows-based SprintWork installations

Discovery Timeline

• 2026-02-07 - CVE CVE-2020-37160 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2020-37160

Vulnerability Analysis

This vulnerability is classified under CWE-276 (Incorrect Default Permissions), indicating that SprintWork 2.3.1 installs with overly permissive file system and service configurations. The local attack vector means an attacker must already have some level of access to the target system, but the low complexity and no user interaction requirements make exploitation straightforward once access is obtained.

The vulnerability allows a local unprivileged user to leverage the weak permissions to plant malicious executables or manipulate service configurations, ultimately leading to code execution with elevated privileges.

Root Cause

The root cause stems from improper default permissions applied during the SprintWork installation process. Specifically, the application fails to properly restrict access to:

• Service executable paths that allow write access to low-privileged users
• Service configurations that can be modified by non-administrative accounts
• Folder structures containing application binaries with inadequate access controls

When services are configured to run executables from paths where unprivileged users have write access, attackers can replace or inject malicious code that executes with the service's elevated privileges (typically SYSTEM).

Attack Vector

The attack requires local access to a Windows system running the vulnerable SprintWork version. An attacker with standard user credentials can:

1. Identify SprintWork services running with elevated privileges
2. Locate missing or writable executable paths referenced by these services
3. Place a malicious executable in the expected path or overwrite existing binaries
4. Wait for service restart or trigger a service restart to execute the payload
5. Achieve code execution as SYSTEM or create new administrative accounts

The exploitation technique leverages classic Windows privilege escalation patterns involving unquoted service paths, missing binaries, and weak folder ACLs. Technical details and proof-of-concept information are available via the Exploit-DB #48070 entry.

Detection Methods for CVE-2020-37160

Indicators of Compromise

• Unexpected executable files appearing in SprintWork installation directories or service paths
• New user accounts with administrative privileges created without authorization
• Modifications to SprintWork service configurations or binary timestamps
• Unusual service restart activity or crash-restart patterns for SprintWork services

Detection Strategies

• Monitor Windows Security Event Logs for Event ID 4688 (new process creation) from SprintWork service paths with unusual parent-child relationships
• Use file integrity monitoring (FIM) on SprintWork installation directories to detect unauthorized changes
• Audit service configuration changes using Windows Event ID 7045 (service installation) and Event ID 4657 (registry value modified)
• Deploy endpoint detection rules to identify privilege escalation patterns involving service manipulation

Monitoring Recommendations

• Enable verbose logging for Windows Service Control Manager events
• Implement real-time alerting for new administrative user creation (Event ID 4720)
• Configure SentinelOne Singularity to monitor for suspicious file writes to service executable paths
• Establish baseline behavior for SprintWork processes and alert on deviations

How to Mitigate CVE-2020-37160

Immediate Actions Required

• Audit current SprintWork installations for insecure file and folder permissions using icacls or PowerShell commands
• Remove write permissions for non-administrative users from SprintWork installation directories and service paths
• Verify all SprintWork services have properly quoted executable paths in the registry
• Consider temporarily disabling vulnerable SprintWork services until remediation is complete

Patch Information

Consult the vendor's official channels for security updates. Review the Veridium SprintWork Overview page and VulnCheck Advisory for SprintWork for the latest patch availability and guidance. Organizations should prioritize upgrading to a patched version as soon as one becomes available.

Workarounds

• Restrict folder permissions on SprintWork installation directory to Administrators and SYSTEM only
• Use Windows Group Policy to enforce least-privilege access on service paths
• Implement application whitelisting to prevent unauthorized executables from running in SprintWork directories
• Deploy SentinelOne endpoint protection to detect and block privilege escalation attempts in real-time

# Example: Restrict permissions on SprintWork installation folder
icacls "C:\Program Files\SprintWork" /inheritance:r
icacls "C:\Program Files\SprintWork" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\Program Files\SprintWork" /grant:r "Administrators:(OI)(CI)F"
icacls "C:\Program Files\SprintWork" /grant:r "Users:(OI)(CI)RX"