CVE-2023-42125
📋 TL;DR
This vulnerability in Avast Premium Security allows local attackers to escalate privileges from low-privileged user accounts to SYSTEM-level access by exploiting a symbolic link flaw in the sandbox protection feature. Attackers must first gain initial access to execute low-privileged code on the target system. Only Avast Premium Security installations with the sandbox feature enabled are affected.
💻 Affected Systems
- Avast Premium Security
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM-level privileges, enabling attackers to install persistent malware, disable security controls, access all user data, and pivot to other systems on the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install additional malware, and maintain persistence on compromised systems.
If Mitigated
Limited impact if proper endpoint security controls, least privilege principles, and network segmentation are implemented to prevent initial low-privileged access.
🎯 Exploit Status
Requires local access and ability to execute low-privileged code first. Symbolic link manipulation requires specific timing and conditions but is well-understood technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references, but Avast has released updates addressing ZDI-CAN-20383
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-23-1475/
Restart Required: Yes
Instructions:
1. Open Avast Premium Security 2. Navigate to Settings > Update 3. Click 'Update' to download and install latest version 4. Restart computer when prompted
🔧 Temporary Workarounds
Disable Sandbox Protection
windowsTemporarily disable the vulnerable sandbox feature until patching can be completed
Open Avast Premium Security > Settings > Protection > Core Shields > Sandbox > Toggle off
🧯 If You Can't Patch
- Implement strict least privilege principles to limit initial low-privileged access opportunities
- Deploy application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Avast Premium Security version and ensure it's updated to latest version. Check if sandbox protection is enabled in settings.Check Version:
Open Avast Premium Security > Menu > AboutVerify Fix Applied:
Verify Avast Premium Security is updated to latest version and restart has been completed. Confirm no privilege escalation attempts succeed in testing.📡 Detection & Monitoring
Log Indicators:
- Unusual symbolic link creation events in Windows security logs
- Avast service privilege escalation attempts
- Unexpected SYSTEM-level process creation from user accounts
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
Windows Security Event ID 4688 with Parent Process containing 'avast' and New Process running as SYSTEM from non-privileged user context