# Unauthorized command execution in Web protection component of Anti-Virus products family

Kaspersky's injected web-protection script exposes its command interface to any page, letting sites disable Anti-Banner/Private Browsing and potentially reach SYSTEM-level code.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-24
- CVE: CVE-2019-15685
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/470544
- Library page: https://bugbountylibrary.com/r/h1%3A470544
- Tags: area:os domain:desktop domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:js-analysis vuln:command-injection vuln:misconfiguration

**Target:** Kaspersky web-protection injected JavaScript / avp.exe command interface
**Root cause:** Without a browser extension, Kaspersky injects its script into webpages; the address-hiding and pre-script injection provisions are bypassable by the page downloading itself and by manipulating stored JS object references before re-running the script.
**Steps:**
1. Enable Anti-Banner and Private Browsing in Kaspersky settings.
2. Run the provided `server.py` HTTP server on http://localhost:5000/ serving `disable_features1.html`.
3. Add `127.0.0.1 www.google.example.com` to the hosts file (host must start with `www.google.` for script injection).
4. Ensure no Kaspersky browser extension is installed; disable and restart browser if present.
5. Visit `http://www.google.example.com:5000/disable_features1.html`.
6. Observe Anti-Banner and Private Browsing are now disabled.
**How found:** Noted that without the extension Kaspersky falls back to injecting a script into pages, and reasoned the address-hiding and pre-injection protections could be defeated by self-download and object manipulation.
**Exploitation:** A malicious page downloads itself to discover the injected script address, manipulates JS object references, re-runs Kaspersky's script, and gains full access to the command interface to disable features, edit blocklists, and potentially attack avp.exe bugs for SYSTEM-level RCE.
**Escalation:** Exposing Kaspersky's internal processing to the web turns bugs in that code into RCE running as SYSTEM.
**Insight:** When a security product injects scripts into pages, test whether the page can re-download itself to locate the injected script and whether stored native object references can be swapped before re-executing the vendor script.

## Write-ups of the same bug (oldest first)
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [IE]](https://bugbountylibrary.com/r/h1%3A470547) — palant
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family](https://bugbountylibrary.com/r/h1%3A470544) — palant (this one)
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [FF, Chrome]](https://bugbountylibrary.com/r/h1%3A470553) — palant