Unquoted Service Path in Avast SecureLine Enables Privilege Escalation

Executive Summary

CVE-2020-37037 is an unquoted service path vulnerability in Avast SecureLine version 5.5.522.0. This means that the service's executable path is not properly quoted, allowing local attackers to insert malicious executables into directories along the service path. When the service starts, these malicious executables can run with elevated system privileges under the LocalSystem account, potentially allowing attackers to execute arbitrary code with high-level permissions. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker to escalate their privileges by executing arbitrary code with LocalSystem account permissions. This means the attacker could gain full control over the affected system, compromising confidentiality, integrity, and availability of the system and its data. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unquoted service paths in the Avast SecureLine service configuration. Specifically, you can inspect the service executable path for missing quotes around directories with spaces. For example, on a Windows system, you can use the command: sc qc SecureLine to query the service configuration and check the ImagePath for unquoted paths. Additionally, you can manually verify if the service executable path "C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe" is unquoted. Detecting unquoted service paths involves looking for executable paths that contain spaces but are not enclosed in quotes, which can be exploited by placing malicious executables in those directories. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include correcting the unquoted service path by enclosing the entire executable path in quotes to prevent malicious code injection. For example, update the service configuration to use a quoted path like ""C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe"". Additionally, ensure that only trusted users have local access to the system, as the vulnerability requires local access to exploit. Applying any available patches or updates from Avast for SecureLine is also recommended to address this issue. [1, 3]

Useful 0 Not Useful 0