CVE-2020-37020: 
SonarQube vulnerability analysis and mitigation

CVE-2020-37020 is an unquoted service path vulnerability in SonarQube 8.3.1 that allows local attackers to escalate privileges to SYSTEM level. The flaw exists in the Windows service executable path configuration, enabling an attacker with low-privileged local access to place a malicious executable in the unquoted path, which is then executed with SYSTEM privileges upon service restart. It was published on January 29, 2026, and is classified as CWE-428 (Unquoted Search Path or Element). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (VulnCheck Advisory, Exploit-DB).

The root cause is CWE-428 (Unquoted Search Path or Element): when a Windows service is registered with an executable path containing spaces but without enclosing quotation marks, the Windows Service Control Manager attempts to resolve the path by testing each space-delimited segment as a potential executable. In SonarQube 8.3.1, the service path for wrapper.exe is unquoted, allowing a local attacker with write access to a parent directory in the path to place a malicious executable (e.g., SonarQube.exe or similar) that Windows will execute before reaching the legitimate binary. Exploitation requires low-privileged local access and no user interaction, and is triggered when the SonarQube service is restarted. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, VulnCheck Advisory).

Successful exploitation grants the attacker SYSTEM-level code execution on the Windows host running SonarQube 8.3.1, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker achieving SYSTEM privileges can access all data on the host — including SonarQube's source code analysis results, credentials, and configuration secrets — install persistent backdoors, disable security controls, and potentially pivot to other systems on the network (VulnCheck Advisory, Exploit-DB).

A public proof-of-concept exploit (EDB-ID 48677) is available on Exploit-DB, lowering the barrier for exploitation. The EPSS score is approximately 0.012% (0.000120), indicating a currently low probability of widespread automated exploitation. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface compared to remote vulnerabilities (Exploit-DB, VulnCheck Advisory).

1. Reconnaissance: Gain low-privileged local access to the Windows host running SonarQube 8.3.1. Enumerate installed services using sc qc SonarQube or wmic service get name,pathname,startmode to identify the unquoted service path for the SonarQube wrapper executable.
2. Identify writable directory: Analyze the unquoted service path (e.g., C:\Program Files\SonarQube 8.3.1\bin\windows-x86-64\wrapper.exe) and determine which parent directory segment (e.g., C:\Program Files\SonarQube) is writable by the current low-privileged user using icacls or similar tools.
3. Place malicious executable: Craft or compile a malicious executable (e.g., a reverse shell or privilege escalation payload) and place it at the path Windows will attempt to resolve first (e.g., C:\Program.exe or C:\Program Files\SonarQube.exe), depending on the exact path and writable location.
4. Trigger service restart: Wait for or trigger a SonarQube service restart (e.g., via system reboot, or if the attacker has permissions to restart services). Windows SCM will execute the malicious binary with SYSTEM privileges before reaching the legitimate wrapper.exe.
5. Achieve SYSTEM access: The malicious executable runs as SYSTEM, granting full control of the host (Exploit-DB, VulnCheck Advisory).

• Logs: Windows System Event Log entries (Event ID 7036, 7045) showing unexpected service state changes or new service registrations; Windows Security Event Log entries (Event ID 4688) showing unusual processes spawned by services.exe with SYSTEM privileges.
• File System: Unexpected executables placed in directories along the SonarQube service path (e.g., C:\Program.exe, C:\Program Files\SonarQube.exe, or similar path-segment executables); modification timestamps on directories in the SonarQube installation path that do not align with legitimate software updates.
• Process: Unusual child processes of services.exe running as SYSTEM that are not the legitimate wrapper.exe; reverse shell or command-and-control processes running under the SYSTEM account originating from the SonarQube service path.
• Network: Unexpected outbound connections from the SonarQube host to external IPs, particularly shortly after a service restart event.

The primary remediation is to upgrade SonarQube to a version that quotes the service executable path correctly; users should check the SonarQube release notes for a patched version beyond 8.3.1. As an immediate workaround, administrators can manually edit the Windows service registry entry (HKLM\SYSTEM\CurrentControlSet\Services\SonarQube) to enclose the ImagePath value in double quotes, ensuring the path is properly quoted. Additionally, restrict write permissions on all directories in the SonarQube installation path to prevent low-privileged users from placing executables there. Regularly audit service paths on Windows hosts using tools like sc qc or Sysinternals Autoruns to detect unquoted paths (VulnCheck Advisory, Exploit-DB).

The vulnerability received limited but notable coverage upon its NVD publication in January 2026, with security blogs such as infinitsec.net and ctrlaltnod.com publishing write-ups on the flaw. Social media activity was modest, with mentions on Bluesky and aggregation by vulnerability tracking platforms. No official public statement from SonarSource (the vendor) has been identified in available sources (infinitsec.net, ctrlaltnod.com).