CVE-2019-25269

Executive Summary

CVE-2019-25269 is a local privilege escalation vulnerability in Amiti Antivirus 25.0.640 caused by an unquoted service path in its Windows service configurations. An attacker with local access can place a malicious executable in a directory path that the service will inadvertently execute due to the lack of quotation marks around the service binary path. This allows the attacker to run arbitrary code with LocalSystem privileges, effectively gaining full control of the affected system.

The vulnerability is unpatched and has a public proof-of-concept (PoC) available. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk is significant for environments where local access is possible.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows service configuration issue in a commercial antivirus product.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector: Local (requires local access)
• Attack Complexity: Low
• Privileges Required: Low (standard user)
• User Interaction: None
• Impact: Complete compromise of confidentiality, integrity, and availability (LocalSystem)
• Threat Level: High for environments with untrusted local users or malware that can drop files.

Deep Dive & Mechanics

The vulnerability lies in the Windows service configuration for Amiti Antivirus. When a service binary path is not enclosed in quotation marks, Windows interprets spaces in the path as delimiters. For example, if the service path is:

C:\Program Files\Amiti Antivirus\amiti-service.exe

Without quotes, Windows will attempt to execute:

1. C:\Program.exe
2. C:\Program Files\Amiti.exe
3. C:\Program Files\Amiti Antivirus\amiti-service.exe

An attacker can place a malicious executable named Program.exe or Amiti.exe in the C:\ or C:\Program Files\ directory, respectively. When the service starts (e.g., at boot or manually), Windows will execute the attacker’s file instead of the legitimate service binary, with LocalSystem privileges.

Vulnerable vs. Patched Code

Vulnerable Service Path (Unquoted):

C:\Program Files\Amiti Antivirus\amiti-service.exe

Patched Service Path (Quoted):

"C:\Program Files\Amiti Antivirus\amiti-service.exe"

The fix is trivial: enclose the path in double quotes. However, the vendor has not released an official patch.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Amiti Antivirus 25.0.640 installed.
• Ability to write to C:\ or C:\Program Files\ (standard user can write to C:\).

Steps:

1. Identify the vulnerable service (e.g., sc qc AmitiService).
2. Place a malicious executable (e.g., Program.exe) in C:\.
3. Trigger service restart (e.g., sc stop AmitiService && sc start AmitiService).
4. The malicious executable runs as LocalSystem.

Example PoC (PowerShell):

# Check service path
sc.exe qc AmitiService

# Place malicious executable
Copy-Item "C:\tools\malicious.exe" "C:\Program.exe"

# Restart service
sc.exe stop AmitiService
sc.exe start AmitiService

Blue Team (Detection & Response)

Detection:

• Monitor for unexpected executables in C:\ or C:\Program Files\ named Program.exe, Amiti.exe, etc.
• Alert on service start events where the binary path is unquoted.
• Use Sysmon Event ID 1 (Process Creation) to detect execution from suspicious paths.

Response:

• Immediately isolate the affected system.
• Review service configurations and add quotes to the binary path.
• Scan for malicious files in common writable directories.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\Program.exe
  • C:\Program Files\Amiti.exe
  • C:\Program Files\Amiti Antivirus\amiti-service.exe (legitimate)
• Service Name: AmitiService (or similar)
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\AmitiService
• Process Name: Program.exe, Amiti.exe
• Event IDs: Windows Event ID 7030 (Service Control Manager error), Sysmon Event ID 1

Detection Engineering

YARA Rule

rule CVE_2019_25269_Unquoted_Service_Path {
    meta:
        description = "Detects unquoted service path for Amiti Antivirus"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25269"
    strings:
        $s1 = "AmitiService" nocase
        $s2 = "C:\\Program Files\\Amiti Antivirus\\" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Unquoted Service Path - Amiti Antivirus
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unquoted service path for Amiti Antivirus service
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7030
        ServiceName: 'AmitiService'
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25269 Unquoted Service Path Exploit"; flow:to_server,established; content:"Program.exe"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually quote the service path using sc config:

   sc config AmitiService binPath="\"C:\Program Files\Amiti Antivirus\amiti-service.exe\""
   

2. Restrict write permissions to C:\ and C:\Program Files\ for standard users.
3. Monitor for suspicious file creation in root directories.

Long-Term:

• Replace Amiti Antivirus with a supported product.
• Apply the principle of least privilege to all services.
• Regularly audit service configurations for unquoted paths.

Patch Status: No official patch from vendor. Manual remediation required.

Valters IT