CVE-2020-37085
📋 TL;DR
CVE-2020-37085 is a denial of service vulnerability in VirtualTablet Server 3.0.2 where attackers can crash the service by sending oversized string payloads through the Thrift protocol. This affects anyone running VirtualTablet Server 3.0.2, potentially disrupting tablet functionality for users.
💻 Affected Systems
- VirtualTablet Server
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage making VirtualTablet Server unavailable to all users, requiring manual restart of the service.
Likely Case
Service becomes unresponsive, disrupting tablet connectivity and functionality until service is restarted.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and block attack attempts.
🎯 Exploit Status
Public exploit code is available on Exploit-DB (ID 48402), making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.sunnysidesoft.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates or consider alternative solutions.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to VirtualTablet Server to trusted hosts only
Use firewall rules to limit access to VirtualTablet Server port (default 2345)
Service Monitoring and Restart
allImplement monitoring to detect service crashes and automatically restart
Create service monitoring script or use systemd/Windows Service recovery options
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the VirtualTablet Server
- Deploy intrusion detection systems to monitor for oversized Thrift protocol payloads
🔍 How to Verify
Check if Vulnerable:
Check if running VirtualTablet Server version 3.0.2. If version matches, system is vulnerable.Check Version:
Check application interface or installation directory for version informationVerify Fix Applied:
No official fix available. Consider upgrading if vendor releases patched version.📡 Detection & Monitoring
Log Indicators:
- Service crash logs
- Unexpected termination of VirtualTablet Server process
Network Indicators:
- Large Thrift protocol payloads to port 2345
- Multiple connection attempts with oversized strings
SIEM Query:
source_port:2345 AND (payload_size > 1000 OR protocol:thrift)