CVE-2024-7237

Executive Summary

CVE-2024-7237 is a local privilege escalation vulnerability in AVG AntiVirus Free, specifically within the AVG Service (AVGSvc). The flaw allows an attacker with low-privileged code execution on the target system to abuse a symbolic link to delete a folder, ultimately leading to privilege escalation to SYSTEM and arbitrary code execution. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched. No public exploit code or proof-of-concept is available, but the risk is significant for enterprise environments using AVG AntiVirus Free.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: Low (PR:L) – attacker needs low-privileged code execution.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full system compromise.
• Integrity Impact: High (I:H) – arbitrary code execution as SYSTEM.
• Availability Impact: High (A:H) – potential denial of service via folder deletion.

Threat Level: High. Exploitation is straightforward for an attacker with local access, and the impact is complete system compromise.

Deep Dive & Mechanics

The vulnerability resides in the AVG Service (AVGSvc), which runs with SYSTEM privileges. The service performs file operations on a folder without properly validating symbolic links. An attacker can create a symbolic link pointing to a critical system folder (e.g., C:\Windows\System32). When the service deletes the folder, it follows the symbolic link and deletes the target, causing a denial of service or enabling further privilege escalation.

Root Cause: The service does not use NtCreateFile with the FILE_OPEN_REPARSE_POINT flag or equivalent checks to prevent following symbolic links. This is a classic CWE-59 (Improper Link Resolution Before File Access) vulnerability.

Attack Flow:

1. Attacker gains low-privileged code execution on the target.
2. Attacker creates a symbolic link from a writable location to a protected system folder.
3. Attacker triggers the AVG service to delete the folder (e.g., via a scheduled scan or manual action).
4. The service follows the symbolic link and deletes the target folder, causing system instability or allowing the attacker to replace files with malicious versions.
5. Attacker escalates to SYSTEM and executes arbitrary code.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the AVG Service binary (AVGSvc.exe). The fix would involve adding symbolic link validation before file deletion operations.

Vulnerable Code (Conceptual):

// Vulnerable: No reparse point check
DeleteFileW(folderPath); // Follows symlink

Patched Code (Conceptual):

// Patched: Check for reparse points
HANDLE hFile = CreateFileW(folderPath, DELETE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, NULL);
if (hFile != INVALID_HANDLE_VALUE) {
    // Safe to delete
    DeleteFileW(folderPath);
    CloseHandle(hFile);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access with low-privileged user account.
• AVG AntiVirus Free installed and running.

Exploitation Steps:

1. Identify a writable folder (e.g., C:\Users\Public\Temp).
2. Create a symbolic link to a protected folder (e.g., C:\Windows\System32\config).
3. Trigger the AVG service to delete the folder (e.g., by initiating a scan that cleans temporary files).
4. After deletion, the system may become unstable, allowing further exploitation.

Example PowerShell Script:

# Create symlink
New-Item -ItemType SymbolicLink -Path "C:\Users\Public\Temp\TargetFolder" -Target "C:\Windows\System32\config"

# Trigger AVG service (simulate scan)
Start-Process -FilePath "C:\Program Files\AVG\Antivirus\AVGSvc.exe" -ArgumentList "/scan"

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for creation of symbolic links by low-privileged users.
• Alert on AVG service accessing unusual paths.
• Use Sysmon Event ID 1 (Process Creation) and Event ID 11 (FileCreate).

Defense:

• Restrict write permissions to sensitive directories.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from untrusted processes.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• File System:
  • Symbolic links created in C:\Users\*\AppData\Local\Temp\ or C:\Users\Public\Temp\ pointing to C:\Windows\System32\ or C:\Program Files\.
• Process:
  • AVGSvc.exe accessing unusual paths (e.g., C:\Windows\System32\config).
• Event Logs:
  • Windows Security Event ID 4663 (An attempt was made to access an object) with AVGSvc.exe as the process.
  • Sysmon Event ID 11 (FileCreate) for symbolic link creation.

Detection Engineering

YARA Rule

rule CVE_2024_7237_Symlink_Abuse {
    meta:
        description = "Detects symbolic link creation targeting system folders for CVE-2024-7237"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-7237"
    strings:
        $symlink_cmd = "New-Item -ItemType SymbolicLink" nocase
        $target_path = "C:\\Windows\\System32" nocase
        $target_path2 = "C:\\Program Files" nocase
    condition:
        $symlink_cmd and ($target_path or $target_path2)
}

Sigma Rule

title: CVE-2024-7237 - AVG AntiVirus Free Symlink Privilege Escalation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects symbolic link creation to system folders by low-privileged users, indicating exploitation of CVE-2024-7237.
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7237
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: 'C:\Users\'
        TargetFilename|endswith: '.lnk'
        Image|endswith: '\powershell.exe' or '\cmd.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7237 - AVG AntiVirus Free Symlink Exploit"; flow:to_server,established; content:"New-Item"; content:"SymbolicLink"; content:"System32"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable AVG AntiVirus Free until a patch is available.
2. Restrict local user permissions to prevent symbolic link creation.
3. Enable Windows Defender as a temporary replacement.

Long-Term Fix:

• Monitor vendor for patch release.
• Implement application whitelisting to block unauthorized scripts.
• Use Group Policy to disable symbolic link creation for non-admin users.

Workaround:

• Configure AVG to run with reduced privileges (if possible).
• Use folder redirection to isolate writable directories.

Valters IT