CVE-2020-37254 Overview
CVE-2020-37254 is a local privilege escalation vulnerability in Wondershare PDFelement 5.2.9. The flaw resides in the WsAppService Windows service, which is registered with an unquoted service path. A local attacker with write access to an intermediate directory in the service path can place a malicious executable that Windows loads at service start. The Service Control Manager then executes the attacker-controlled binary under the LocalSystem account. The issue is tracked under CWE-428: Unquoted Search Path or Element.
Critical Impact
Successful exploitation grants NT AUTHORITY\SYSTEM code execution from a low-privileged local user account.
Affected Products
- Wondershare PDFelement version 5.2.9
- WsAppService Windows service component
- Installations deployed via pdfelement_setup_full1042.exe
Discovery Timeline
- 2026-06-19 - CVE-2020-37254 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2020-37254
Vulnerability Analysis
The vulnerability stems from improper quoting of the executable path registered for the WsAppService Windows service. Windows parses unquoted service paths by tokenizing on spaces and attempting to execute each successive prefix as a binary. When an installation directory contains spaces, the Service Control Manager probes intermediate paths before resolving the intended executable. An attacker who can write to any of those intermediate locations can stage a malicious binary that runs in place of the legitimate service executable.
Wondershare PDFelement runs WsAppService under the LocalSystem account, so any code executed during service startup inherits full system privileges. The vulnerability requires only a local, low-privileged account and does not require user interaction.
Root Cause
The service installer registers the WsAppServiceImagePath registry value without enclosing the executable path in double quotes. Combined with permissive directory access control lists on parent folders within the install path, this configuration creates a path hijacking primitive classified under CWE-428.
Attack Vector
A local attacker enumerates Windows services and identifies WsAppService with an unquoted ImagePath. The attacker writes a payload binary into an intermediate path location whose name matches the first whitespace-delimited token. When the service restarts or the system reboots, Windows executes the planted binary as LocalSystem. Persistence and full host compromise follow. Refer to the VulnCheck advisory and Exploit-DB entry 40535 for technical details.
Detection Methods for CVE-2020-37254
Indicators of Compromise
- Unexpected executables placed in directories along the WsAppService install path, particularly files whose names match the first token of the service path.
- New child processes spawned by services.exe with a parent image path that differs from the documented WsAppService binary.
- Recent modifications to access control lists on Wondershare PDFelement installation directories permitting writes by non-administrative users.
Detection Strategies
- Query the Windows registry for HKLM\SYSTEM\CurrentControlSet\Services\WsAppService\ImagePath and flag values that contain spaces but are not enclosed in double quotes.
- Run wmic service get name,pathname,startmode and filter for paths containing whitespace without surrounding quotes.
- Audit directory ACLs along each segment of the service path to identify locations writable by Users or Authenticated Users.
Monitoring Recommendations
- Forward Windows Service Control Manager events (Event IDs 7034, 7036, 7045) to a centralized logging platform and correlate with file creation events in install directories.
- Monitor process creation telemetry (Event ID 4688 / Sysmon Event ID 1) for LocalSystem processes whose parent is services.exe and whose image path resides outside expected program directories.
How to Mitigate CVE-2020-37254
Immediate Actions Required
- Inventory all hosts running Wondershare PDFelement 5.2.9 and identify those exposing WsAppService with an unquoted path.
- Restrict NTFS permissions on the PDFelement installation path so only administrators and SYSTEM can write to any directory in the service path.
- Remove or upgrade the vulnerable PDFelement 5.2.9 installation where the service is no longer required.
Patch Information
No vendor patch is referenced in the available advisory data. Consult the Wondershare official website for current PDFelement releases and upgrade to a supported version that quotes service paths and ships with hardened directory permissions.
Workarounds
- Manually edit the ImagePath value under HKLM\SYSTEM\CurrentControlSet\Services\WsAppService to wrap the executable path in double quotes, then restart the service.
- Set the WsAppService start type to Disabled using sc config WsAppService start= disabled if the functionality is not required.
- Apply the principle of least privilege to local accounts to reduce the population of users able to stage payloads in writable path segments.
# Configuration example: quote the service path and tighten permissions
sc qc WsAppService
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WsAppService" /v ImagePath /t REG_EXPAND_SZ /d "\"C:\Program Files\Wondershare\PDFelement\WsAppService.exe\"" /f
icacls "C:\Program Files\Wondershare" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
sc stop WsAppService && sc start WsAppService
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
