CVE-2024-13188
📋 TL;DR
This vulnerability in MicroWorld eScan Antivirus 7.0.32 on Linux allows local attackers to exploit incorrect default permissions in the installation handler component. Attackers with local access can potentially escalate privileges or modify protected files. Only Linux systems running the affected antivirus version are impacted.
💻 Affected Systems
- MicroWorld eScan Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, antivirus bypass, or persistence mechanisms installation
Likely Case
Unauthorized file modification in protected directories, potential antivirus evasion, or limited privilege escalation
If Mitigated
Minimal impact if proper access controls and least privilege principles are enforced on the system
🎯 Exploit Status
Exploit details are publicly available on GitHub, requires local access to the system
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider alternative antivirus solutions or implement workarounds.
🔧 Temporary Workarounds
Correct directory permissions
linuxManually set proper permissions on the vulnerable directory to prevent unauthorized access
sudo chmod 750 /opt/MicroWorld/var/
sudo chown root:root /opt/MicroWorld/var/
Remove unnecessary access
linuxRestrict access to the installation handler directory to only necessary users/groups
sudo chmod 700 /opt/MicroWorld/var/
sudo setfacl -m u:escanuser:rwx /opt/MicroWorld/var/
🧯 If You Can't Patch
- Implement strict access controls and least privilege principles on affected systems
- Monitor file system changes in /opt/MicroWorld/var/ directory using auditd or similar tools
🔍 How to Verify
Check if Vulnerable:
Check if eScan Antivirus version 7.0.32 is installed and examine permissions on /opt/MicroWorld/var/ directoryCheck Version:
rpm -qa | grep escan or dpkg -l | grep escanVerify Fix Applied:
Verify directory permissions are properly set (e.g., 750 or more restrictive) and owned by root📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /opt/MicroWorld/var/
- Permission changes on protected directories
- Suspicious file modifications in antivirus directories
Network Indicators:
- None - local-only vulnerability
SIEM Query:
source="audit.log" AND (path="/opt/MicroWorld/var/*" OR perm_changed="*MicroWorld*")