CVE-2020-15351: 
IDrive vulnerability analysis and mitigation

IDrive for Windows prior to version 6.7.3.19 installs by default to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions that grant any authenticated user modify permissions to the contents of the directory and its sub-folders. The vulnerability is tracked as CVE-2020-15351 and was discovered in June 2020 (Active Labs).

The vulnerability stems from improper folder permissions configuration where NT AUTHORITY\Authenticated Users are granted (OI)(CI)(M) permissions to the installation directory. Additionally, the program installs a service called IDriveService that runs with Local System privileges (Active Labs).

This vulnerability allows any standard user to escalate privileges to NT AUTHORITY\SYSTEM by substituting the service's binary with a malicious one, effectively gaining complete control over the system (Active Labs).

The vulnerability is easily exploitable by any authenticated user on the system due to the weak folder permissions. An attacker only needs to replace the service binary with malicious code to achieve privilege escalation (Active Labs).

The vulnerability has been patched in IDrive version 6.7.3.19. Users should upgrade to this version or later to address the security issue (IDrive Release, Active Labs).