{"vulnerability": "cve-2020-17136", "sightings": [{"uuid": "7549d640-05fb-41b9-9e7f-b7e48c79ee4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "7de80307-755a-48c2-8373-9d5d7bfc2de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:25.000000Z"}, {"uuid": "9499c521-6092-4440-aeed-1b8f712819bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_17136.rb", "content": "", "creation_timestamp": "2021-01-11T22:23:00.000000Z"}, {"uuid": "98e1c00f-f775-41ae-b689-99da77ac6dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3m5fdzfhfns2w", "content": "", "creation_timestamp": "2025-11-12T00:03:35.888226Z"}, {"uuid": "13c9e9c3-a670-4806-8776-dc57ab87a726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:00:53.000000Z"}, {"uuid": "3e3f9f16-c821-4b73-bee1-7f8537a17c83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2490", "content": "#exploit\nCVE-2020-17136:\nCloud Filter Arbitrary File Creation EoP\nhttps://github.com/rapid7/metasploit-framework/pull/14585\n// LPE on Win10 1803 and later", "creation_timestamp": "2024-10-09T20:01:43.000000Z"}, {"uuid": "4e2e3060-9747-4ccd-986d-79541905537f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "https://t.me/cissp/2079", "content": "1. Adventures in Reversing Malicious Run-Only AppleScripts\nhttps://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts\n\n2. SUNSPOT Malware: An Implant in the Build Process\nhttps://www.crowdstrike.com/blog/sunspot-malware-technical-analysis\n\n1. Pentesting the ELK (Elasticsearch, Logstash, Kibana) Stack\nhttps://insinuator.net/2021/01/\npentesting-the-elk-stack\n\n2. Hiding execution of unsigned code in system threads\nhttps://secret.club/2021/01/12/callout.html\n]-> callout-poc:\nhttps://github.com/thesecretclub/callout-poc\n\nStrengthening Security Configurations to Defend Against Attackers Targeting Cloud Services\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-013a\n\n1. Breaking Google Chrome browser running on Windows (PoC)\nhttps://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors\n\n2. Flutter based Mac OSX Thick Client SSL Pinning Bypass\nhttps://notsosecure.com/flutter-based-mac-osx-thick-client-ssl-pinning-bypass\n\nLeaking Silhouettes of Cross-Origin Images\nhttps://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images\n]-> PoC for CVE-2020-16012, a timing side channel in drawImage in Firefox/Chrome\nhttps://github.com/aleksejspopovs/cve-2020-16012\n\nCreate module for CVE-2020-17136:\nCloud Filter Arbitrary File Creation EoP (PoC)\n// LPE on Windows 10 1803 and later\nhttps://github.com/rapid7/metasploit-framework/pull/14585", "creation_timestamp": "2026-09-01T17:01:06.591836Z"}, {"uuid": "0b124340-b241-4bbc-bc3b-090e8a9f3930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "https://t.me/cissp/2079", "content": "1. Adventures in Reversing Malicious Run-Only AppleScripts\nhttps://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts\n\n2. SUNSPOT Malware: An Implant in the Build Process\nhttps://www.crowdstrike.com/blog/sunspot-malware-technical-analysis\n\n1. Pentesting the ELK (Elasticsearch, Logstash, Kibana) Stack\nhttps://insinuator.net/2021/01/\npentesting-the-elk-stack\n\n2. Hiding execution of unsigned code in system threads\nhttps://secret.club/2021/01/12/callout.html\n]-> callout-poc:\nhttps://github.com/thesecretclub/callout-poc\n\nStrengthening Security Configurations to Defend Against Attackers Targeting Cloud Services\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-013a\n\n1. Breaking Google Chrome browser running on Windows (PoC)\nhttps://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors\n\n2. Flutter based Mac OSX Thick Client SSL Pinning Bypass\nhttps://notsosecure.com/flutter-based-mac-osx-thick-client-ssl-pinning-bypass\n\nLeaking Silhouettes of Cross-Origin Images\nhttps://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images\n]-> PoC for CVE-2020-16012, a timing side channel in drawImage in Firefox/Chrome\nhttps://github.com/aleksejspopovs/cve-2020-16012\n\nCreate module for CVE-2020-17136:\nCloud Filter Arbitrary File Creation EoP (PoC)\n// LPE on Windows 10 1803 and later\nhttps://github.com/rapid7/metasploit-framework/pull/14585", "creation_timestamp": "2026-09-02T01:04:56.565189Z"}, {"uuid": "32f761f3-e320-4adb-88c4-155ce128f81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_17136.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x64\", \"author\": [\"James Foreshaw\", \"Grant Willcox\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"The Cloud Filter driver, cldflt.sys, on Windows 10 v1803 and later, prior to the December\\n          2020 updates, did not set the IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCESS_CHECK flags when\\n          calling FltCreateFileEx() and FltCreateFileEx2() within its HsmpOpCreatePlaceholders()\\n          function with attacker controlled input. This meant that files were created with\\n          KernelMode permissions, thereby bypassing any security checks that would otherwise\\n          prevent a normal user from being able to create files in directories\\n          they don't have permissions to create files in.\\n\\n          This module abuses this vulnerability to perform a DLL hijacking attack against the\\n          Microsoft Storage Spaces SMP service, which grants the attacker code execution as the\\n          NETWORK SERVICE user. Users are strongly encouraged to set the PAYLOAD option to one\\n          of the Meterpreter payloads, as doing so will allow them to subsequently escalate their\\n          new session from NETWORK SERVICE to SYSTEM by using Meterpreter's \\\"getsystem\\\" command\\n          to perform RPCSS Named Pipe Impersonation and impersonate the SYSTEM user.\", \"disclosure_date\": \"2020-03-10\", \"fullname\": \"exploit/windows/local/cve_2020_17136\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"CVE-2020-1170 Cloud Filter Arbitrary File Creation EOP\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/local/cve_2020_17136.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/local/cve_2020_17136\", \"references\": [\"CVE-2020-17136\", \"URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=2082\", \"URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-17136\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows DLL Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:08.313450Z"}, {"uuid": "42b5ec41-30aa-4f56-a4cf-5f1420699ad3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2079", "content": "1. Adventures in Reversing Malicious Run-Only AppleScripts\nhttps://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts\n\n2. SUNSPOT Malware: An Implant in the Build Process\nhttps://www.crowdstrike.com/blog/sunspot-malware-technical-analysis\n\n1. Pentesting the ELK (Elasticsearch, Logstash, Kibana) Stack\nhttps://insinuator.net/2021/01/\npentesting-the-elk-stack\n\n2. Hiding execution of unsigned code in system threads\nhttps://secret.club/2021/01/12/callout.html\n]-> callout-poc:\nhttps://github.com/thesecretclub/callout-poc\n\nStrengthening Security Configurations to Defend Against Attackers Targeting Cloud Services\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-013a\n\n1. Breaking Google Chrome browser running on Windows (PoC)\nhttps://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors\n\n2. Flutter based Mac OSX Thick Client SSL Pinning Bypass\nhttps://notsosecure.com/flutter-based-mac-osx-thick-client-ssl-pinning-bypass\n\nLeaking Silhouettes of Cross-Origin Images\nhttps://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images\n]-> PoC for CVE-2020-16012, a timing side channel in drawImage in Firefox/Chrome\nhttps://github.com/aleksejspopovs/cve-2020-16012\n\nCreate module for CVE-2020-17136:\nCloud Filter Arbitrary File Creation EoP (PoC)\n// LPE on Windows 10 1803 and later\nhttps://github.com/rapid7/metasploit-framework/pull/14585", "creation_timestamp": "2026-09-11T21:00:04.839172Z"}, {"uuid": "317c465a-370e-4acd-9333-095e8431904d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-17136", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2079", "content": "1. Adventures in Reversing Malicious Run-Only AppleScripts\nhttps://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts\n\n2. SUNSPOT Malware: An Implant in the Build Process\nhttps://www.crowdstrike.com/blog/sunspot-malware-technical-analysis\n\n1. Pentesting the ELK (Elasticsearch, Logstash, Kibana) Stack\nhttps://insinuator.net/2021/01/\npentesting-the-elk-stack\n\n2. Hiding execution of unsigned code in system threads\nhttps://secret.club/2021/01/12/callout.html\n]-> callout-poc:\nhttps://github.com/thesecretclub/callout-poc\n\nStrengthening Security Configurations to Defend Against Attackers Targeting Cloud Services\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-013a\n\n1. Breaking Google Chrome browser running on Windows (PoC)\nhttps://www.mdsec.co.uk/2021/01/breaking-the-browser-a-tale-of-ipc-credentials-and-backdoors\n\n2. Flutter based Mac OSX Thick Client SSL Pinning Bypass\nhttps://notsosecure.com/flutter-based-mac-osx-thick-client-ssl-pinning-bypass\n\nLeaking Silhouettes of Cross-Origin Images\nhttps://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images\n]-> PoC for CVE-2020-16012, a timing side channel in drawImage in Firefox/Chrome\nhttps://github.com/aleksejspopovs/cve-2020-16012\n\nCreate module for CVE-2020-17136:\nCloud Filter Arbitrary File Creation EoP (PoC)\n// LPE on Windows 10 1803 and later\nhttps://github.com/rapid7/metasploit-framework/pull/14585", "creation_timestamp": "2026-09-12T00:00:29.393315Z"}]}