CVE-2024-22014
📋 TL;DR
This vulnerability in 360 Total Security Antivirus allows attackers to escalate privileges by exploiting symbolic link following to delete arbitrary files. Attackers can leverage this to gain SYSTEM-level access on Windows systems. Only users running the vulnerable antivirus software on Windows are affected.
💻 Affected Systems
- 360 Total Security Antivirus
📦 What is this software?
360 Total Security by 360totalsecurity
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the Windows system, data destruction, and persistence establishment.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, delete critical system files, and install malware or backdoors.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though file deletion could still cause service disruption.
🎯 Exploit Status
Proof of concept code is publicly available on GitHub. Exploitation requires local access to the system but is relatively straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 11.0.0.1061
Vendor Advisory: Not publicly available from vendor
Restart Required: Yes
Instructions:
1. Open 360 Total Security. 2. Check for updates in settings. 3. Install any available updates. 4. Restart the computer to ensure the patch is fully applied.
🔧 Temporary Workarounds
Disable 360 Total Security Service
windowsTemporarily disable the antivirus service to prevent exploitation
sc stop 360TotalSecurity
sc config 360TotalSecurity start= disabled
Remove Symbolic Link Privileges
windowsRestrict symbolic link creation for non-administrative users
secedit /export /cfg secpol.cfg
Edit secpol.cfg to set 'Create symbolic links' to Administrators only
secedit /configure /db secpol.sdb /cfg secpol.cfg
🧯 If You Can't Patch
- Uninstall 360 Total Security and replace with alternative antivirus solution
- Implement strict access controls and monitor for suspicious file deletion activities
🔍 How to Verify
Check if Vulnerable:
Check 360 Total Security version in the application interface or via 'wmic product get name,version' commandCheck Version:
wmic product where "name like '%360 Total Security%'" get versionVerify Fix Applied:
Verify version is greater than 11.0.0.1061 and test symbolic link creation/deletion scenarios📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in Windows Security logs
- Antivirus service restart events
- Symbolic link creation by non-admin users
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
EventID=4663 AND ObjectName LIKE '%\360TotalSecurity%' AND AccessMask=0x10000