CVE-2021-47787
📋 TL;DR
CVE-2021-47787 is an unquoted service path vulnerability in TotalAV antivirus software that allows attackers with local access to place malicious executables in specific unquoted path segments. When exploited, this can lead to privilege escalation to SYSTEM-level access. Users running TotalAV 5.15.69 on Windows systems are affected.
💻 Affected Systems
- TotalAV Antivirus
📦 What is this software?
Totalav by Totalav
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM-level compromise of the Windows host, allowing complete control over the system, installation of persistent malware, credential theft, and lateral movement within the network.
Likely Case
Local privilege escalation from a lower-privileged user account to SYSTEM, enabling installation of additional malware, disabling security controls, or accessing sensitive system resources.
If Mitigated
Limited impact if proper access controls prevent unauthorized users from writing to system directories and if endpoint detection is monitoring for suspicious service behavior.
🎯 Exploit Status
Exploitation requires local access and ability to write to specific directories in the service path. Proof-of-concept code is publicly available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 5.15.69
Vendor Advisory: https://www.totalav.com
Restart Required: Yes
Instructions:
1. Update TotalAV to the latest version. 2. Restart the system to ensure updated services are running. 3. Verify that service paths are properly quoted in the Windows Service configuration.
🔧 Temporary Workarounds
Manually quote service paths
windowsManually edit the service configuration to add quotes around paths containing spaces
sc config "ServiceName" binPath= "\"C:\Program Files\TotalAV\service.exe\""
sc stop "ServiceName"
sc start "ServiceName"
Restrict directory permissions
windowsSet strict ACLs on directories in the unquoted service path to prevent unauthorized writes
icacls "C:\Program Files\TotalAV" /deny Users:(OI)(CI)W
icacls "C:\Program Files (x86)\TotalAV" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Remove write permissions for non-administrative users on directories in the TotalAV installation path
- Monitor for suspicious file creation in TotalAV directories and unexpected service behavior
🔍 How to Verify
Check if Vulnerable:
Check if TotalAV services have unquoted paths containing spaces: sc qc "ServiceName" | findstr BINARY_PATH_NAMECheck Version:
Check TotalAV about section or look at installed programs in Control PanelVerify Fix Applied:
Verify service paths are quoted and check TotalAV version is greater than 5.15.69📡 Detection & Monitoring
Log Indicators:
- Unexpected service restarts
- File creation events in TotalAV directories by non-administrative users
- Process creation from unusual locations in service paths
Network Indicators:
- Unusual outbound connections from SYSTEM-level processes
- DNS queries for command and control domains from svchost.exe or TotalAV processes
SIEM Query:
EventID=4688 AND NewProcessName contains "TotalAV" AND SubjectUserName!=SYSTEM AND ParentProcessName contains "services.exe"