CVE-2020-17381: 
Total Commander vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2020-17381) was discovered in Ghisler Total Commander version 9.51. The vulnerability was identified on July 22, 2020, and publicly disclosed on October 21, 2020. The issue affects both 32-bit and 64-bit versions of Total Commander 9.51, allowing local attackers to exploit insufficient access restrictions in the default installation directory (GitHub Advisory).

The vulnerability stems from incorrect default permissions (CWE-276) in the %SYSTEMDRIVE%\totalcmd\ installation directory, which allows members of the 'Authenticated Users' group to modify its contents. The vulnerability has a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability enables local attackers to execute arbitrary code by replacing the TOTALCMD64.EXE binary with a malicious version. When another user (particularly an administrator) launches the application, the malicious code executes in their security context, potentially leading to privilege escalation and lateral movement across the network (GitHub Advisory).

A proof-of-concept exploit has been demonstrated showing how an attacker can replace the legitimate TOTALCMD64.EXE with a malicious binary and achieve privilege escalation when an administrator executes the program. The attack has been verified on both 32-bit and 64-bit versions of Total Commander 9.51 (GitHub Advisory).

The vendor has decided not to patch this vulnerability, stating that most users are local administrators anyway. The recommended workaround is to install the application in %SYSTEMDRIVE%\Program Files\ or %SYSTEMDRIVE%\Program Files(x86)\ instead of the default location, as these directories by default only allow 'Authenticated Users' to read and execute contents (GitHub Advisory).

The vendor's response to the vulnerability was notable, as they chose not to implement a fix, stating that the current user base wouldn't be affected since most users are local administrators. This decision was made despite the security implications and potential risks to users (GitHub Advisory).