CVE-2020-7352: The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded…

PriorityP357high8.8CVSS 3.1

AVLACLPRLUINSCCHIHAH

EXPLOIT

EPSS

3.78%

88.6th percentile

The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, static RSA private key, an attacker with this key material and local user permissions can effectively send any operating system command to the service for execution in this elevated context. The service listens for such commands on a locally-bound network port, localhost:9978. A Metasploit module has been published which exploits this vulnerability. This issue affects the 2.0.x branch of the software (2.0.12 and earlier) as well as the 1.2.x branch (1.2.64 and earlier). A fix was issued for the 2.0.x branch of the affected software.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
gog	galaxy	1.2.0 – 1.2.64	—
gog	galaxy	2.0.0 – 2.0.12	—
gog	gog_galaxyclientservice	1.2.64 – 1.2.64	—
gog	gog_galaxyclientservice	2.0.12 – 2.0.12	—

Detection & IOCsextracted from sources · hover to see the quote

portlocalhost:9978↗

→Monitor for unexpected network connections or listening sockets on localhost port 9978, which is used by the vulnerable GalaxyClientService to receive privileged OS command execution requests. ↗
→A public Metasploit module exists for this vulnerability targeting GOG GalaxyClientService privilege escalation; detect exploitation attempts by monitoring for the Metasploit module's use against localhost:9978. ↗
→Alert on processes spawned by GalaxyClientService (running as SYSTEM) that are not typical child processes, as exploitation causes arbitrary OS commands to be executed with SYSTEM privileges via the service. ↗
→The exploit leverages a static, embedded RSA private key shipped with the software; detect presence of this key material on disk or in memory as an indicator of pre-exploitation staging. ↗

·Exploitation requires local user permissions only (not admin); the attack surface is any local user on the affected Windows system, making this a local privilege escalation rather than a remote attack. ↗
·Both the 1.2.x branch (up to 1.2.64) and the 2.0.x branch (up to 2.0.12) are affected; a fix was only issued for the 2.0.x branch, meaning 1.2.x installations remain permanently vulnerable. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.