CVE-2020-37230: Syncplify Server Privilege Escalation Flaw

CVE-2020-37230 Overview

CVE-2020-37230 is an unquoted service path vulnerability in Syncplify.me Server! version 5.0.37. The flaw resides in the SMWebRestServicev5 Windows service, which registers its binary path without surrounding quotes. Local authenticated attackers can place a malicious executable along the service path and gain code execution as LocalSystem when the service restarts or the host reboots. The weakness is classified under CWE-428: Unquoted Search Path or Element.

Critical Impact
Successful exploitation grants full SYSTEM-level privileges on the Windows host, enabling persistence, credential theft, and lateral movement from a low-privileged foothold.

Affected Products

Syncplify.me Server! 5.0.37 (Windows)
SMWebRestServicev5 Windows service component
Installations deployed via SMServer_Setup.exe

Discovery Timeline

2026-05-16 - CVE-2020-37230 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2020-37230

Vulnerability Analysis

The SMWebRestServicev5 service is registered with an unquoted ImagePath that contains spaces. When the Windows Service Control Manager (SCM) parses the path, it attempts to load each whitespace-delimited token as an executable before falling back to the intended binary. An attacker with write access to any intermediate directory along the path can drop a malicious binary that the SCM launches in place of the legitimate service executable.

Because Windows services run under the security context configured at registration, and SMWebRestServicev5 runs as LocalSystem, the planted executable inherits SYSTEM privileges. This converts a local low-privileged user into a full administrator on the host.

Root Cause

The root cause is improper quoting of the service ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\SMWebRestServicev5. The installer fails to wrap the binary path in double quotes, leaving the SCM's space-delimited path resolution behavior exploitable per [CWE-428].

Attack Vector

Exploitation requires local access and the ability to write a file into a directory segment of the unquoted path, such as C:\Program Files\Syncplify.me\. The attacker drops a payload named to match the first whitespace-delimited token, then waits for a service restart or system reboot. On the next service start, the SCM executes the attacker-controlled binary as LocalSystem.

The vulnerability requires no user interaction and no network access. A public proof of concept is documented in Exploit-DB entry 49009 and the VulnCheck advisory.

Detection Methods for CVE-2020-37230

Indicators of Compromise

Unexpected executables present in directories along the SMWebRestServicev5 service path, such as C:\Program.exe or C:\Program Files\Syncplify.exe.
New child processes spawned by services.exe running as NT AUTHORITY\SYSTEM from non-standard paths.
Modification or creation events on files in C:\Program Files\Syncplify.me\ by non-administrative users.

Detection Strategies

Audit all Windows services for unquoted ImagePath values containing spaces using wmic service get name,pathname,startmode or PowerShell Get-CimInstance Win32_Service.
Hunt for process creation events (Sysmon Event ID 1) where the parent is services.exe and the image path resolves outside the installation directory.
Correlate file-write events in privileged directories with subsequent service start events in the System event log (Event ID 7036).

Monitoring Recommendations

Monitor changes to the HKLM\SYSTEM\CurrentControlSet\Services\SMWebRestServicev5 registry key, especially the ImagePath value.
Alert on file creation in root directories such as C:\ and C:\Program Files\ by non-privileged accounts.
Track Windows service restart events for Syncplify services and validate the executing binary hash against the vendor-supplied installer.

How to Mitigate CVE-2020-37230

Immediate Actions Required

Manually quote the ImagePath registry value for SMWebRestServicev5 so the full path is enclosed in double quotes.
Restrict NTFS permissions on C:\ and any intermediate directories so only administrators can create or modify executables.
Inventory all installed Syncplify components and identify hosts running version 5.0.37.

Patch Information

Upgrade Syncplify.me Server! to a version later than 5.0.37, where the installer registers the service path with proper quoting. The latest installer is available from the Syncplify SMServer download. Refer to the VulnCheck advisory for vendor remediation guidance.

Workarounds

Edit the service ImagePath registry value to wrap the binary path in double quotes, then restart the service to apply the change.
Remove write permissions for non-administrative users on every directory segment along the service path.
Disable the SMWebRestServicev5 service on hosts where the REST interface is not required until patching is complete.

bash

# Verify and remediate unquoted service paths on Windows
# List services with unquoted paths containing spaces
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "\""

# Correct the ImagePath for SMWebRestServicev5 (run as Administrator)
sc.exe config SMWebRestServicev5 binPath= "\"C:\Program Files\Syncplify.me\Server\SMWebRestServicev5.exe\""

# Restart the service to apply the change
sc.exe stop SMWebRestServicev5
sc.exe start SMWebRestServicev5