Local Privilege Escalation Zero-Day Vulnerability Discovered in Avast Antivirus
Recent developments in cybersecurity have unveiled a critical zero-day vulnerability in GenDigital’s Avast Antivirus, as disclosed by a public proof-of-concept (PoC) repository. The vulnerability, attributed to local privilege escalation, poses significant risks for users as it permits attackers to dump the Windows Security Account Manager (SAM) database and execute a command shell with the highest level of system privileges, running as NT AUTHORITY\SYSTEM.
The researcher known as MSNightmare has identified this flaw, which is reportedly affecting fully patched installations of Avast Antivirus on systems running Windows 11 25H2. The implications of this vulnerability are profound, especially within the context of cybersecurity, where protecting sensitive user information is paramount.
Details of the Vulnerability
The PoC can be found in a GitHub repository named PrettyPrague, which outlines that the vulnerability arises from a flaw in the Avast Sandbox component. According to the README associated with the repository, it facilitates local execution access, granting an attacker the ability to exploit the elevated privileges of the sandbox to retrieve the SAM database, thereby obtaining a full SYSTEM-level command shell.
Running processes as SYSTEM on Windows grants the highest local privileges, which make it particularly alarming if this vulnerability is validated. It has the potential to completely undermine the security defenses that are intended to protect users. Traditionally, antivirus software is designed to defend the operating system from threats, but this flaw transforms it into a vector through which an attacker could gain comprehensive local access.
Risks and Consequences
The Security Account Manager database is undeniably crucial as it contains sensitive local account credentials alongside password hashes. Unauthorized access to the SAM hive can facilitate dangerous outcomes such as offline password cracking, credential theft, and lateral movement within organizational networks using compromised local administrator credentials.
According to MSNightmare, the PoC is compatible with “any version of Avast Antivirus” and has been tested successfully with the patched versions of Avast and Windows 11 25H2. While the repository has been recently updated with various technical resources including C and C++ source code, Visual Studio project files, and compiled libraries, it does not yet include a formal release, CVE identifier, or patch details. Furthermore, the researcher has speculated that similar vulnerabilities may exist in other GenDigital products, such as AVG and Norton, although these assertions remain unconfirmed pending verification from the vendor.
Increased Urgency for Cyber Defenders
The combination of accessible source code and a compiled release in the PoC heightens the urgency for cybersecurity defenders to act. Public proof-of-concept exploits can hasten validation processes for independent researchers, yet they also diminish the barriers for threat actors who already possess local access to affected Windows endpoints.
In terms of exploiting the vulnerability, it is categorized as a local elevation-of-privilege issue rather than an initial access flaw. An attacker would require prior ability to execute code on a machine, which could potentially be gained through various methods such as phishing attacks, malicious downloads, stolen remote-access credentials, exploitation of existing bugs, or utilizing legitimate software inappropriately.
Recommended Precautions
Security teams are urged to keep a vigilant eye on unusual child process activities initiated by Avast-related services, as well as unexpected command interpreters running under SYSTEM. Additionally, they should monitor access to the SAM registry hive and be alert for any unusual creation of registry hive dump files.
Reviewing endpoint telemetry for unexpected access to HKLM\SAM or HKLM\SYSTEM, alongside specific paths related to registry backup and credential-dumping activities, will be essential for identifying potential compromise.
Organizations employing Avast Antivirus are advised to conduct an inventory of their deployed versions, enforcing stricter controls around local administrator access, and preventing unauthorized users from executing binaries on endpoints. It is also recommended to apply any vendor-provided mitigations or updates promptly once they become available.
It is crucial for defenders not to assume that other GenDigital products are vulnerable simply based on preliminary claims provided in the repository, awaiting a formal announcement and thorough investigation from the organization.
In conclusion, the emergence of this zero-day vulnerability emphasizes the ongoing need for robust cybersecurity measures and vigilant monitoring of endpoint security. The nature of this vulnerability illustrates that even well-established antivirus measures can, in certain cases, become vectors for attacks if not adequately secured, reinforcing the necessity for ongoing diligence in the cybersecurity landscape.