cve/2020/CVE-2020-10143.md

### [CVE-2020-10143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10143)
![](https://img.shields.io/static/v1?label=Product&message=Reflect&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=7.2%3E%3D%207.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brighgreen)

### Description

Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/chnzzh/OpenSSL-CVE-lib