# Unauthorized command execution in Web protection component of Anti-Virus products family [IE]

Kaspersky IE add-on runs its script in page context; a site hijacks String.indexOf to reach Kaspersky's namespace and command interface, disabling protections.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-24
- CVE: CVE-2019-15685
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/470547
- Library page: https://bugbountylibrary.com/r/h1%3A470547
- Tags: area:os domain:desktop domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:windows technique:js-analysis vuln:command-injection vuln:prototype-pollution

**Target:** Kaspersky Web protection browser add-on for Internet Explorer (avp.exe command interface)
**Root cause:** The add-on's injected script executes in the same JS context as the untrusted webpage; only some globals (WebSocket) are protected, so built-ins like String.indexOf remain hookable, leaking the script's namespace.
**Steps:**
1. Enable Anti-Banner and Private Browsing in Kaspersky settings.
2. Serve `disable_features2.html` from a local HTTPS server (e.g. `server.py` on https://localhost:5000/).
3. Add `127.0.0.1 www.google.example.com` to the hosts file so the hostname starts with `www.google.` and triggers script injection.
4. Open `https://www.google.example.com:5000/disable_features2.html` in Internet Explorer, accepting the invalid certificate.
5. Page hooks `String.indexOf()` to capture Kaspersky's namespace and call its command interface; verify Anti-Banner and Private Browsing are now disabled.
**How found:** Prior report (470544) showed the add-on re-injecting its script; here the researcher noted the script still shares the page context, checked which globals were hardened (WebSocket) versus not, and hypothesized built-in methods like String.indexOf could be hooked to leak the namespace.
**Exploitation:** Attacker-controlled page hooks String.indexOf to intercept Kaspersky's script calls, obtains its namespace, then invokes the command interface to disable Anti-Banner/Private Browsing globally or per-site, add blocklist URLs, etc. Potential further exploitation of avp.exe (SYSTEM) bugs was theorized but not pursued.
**Escalation:** Theorized chaining: exposing internal processing to the web could turn avp.exe bugs into RCE at SYSTEM privileges.
**Insight:** When a vendor hardens only a few globals against page-context tampering, enumerate the remaining built-ins (String/Array/JSON methods) the injected script calls and hook those to capture its internal namespace.

## Write-ups of the same bug (oldest first)
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [IE]](https://bugbountylibrary.com/r/h1%3A470547) — palant (this one)
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family](https://bugbountylibrary.com/r/h1%3A470544) — palant
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [FF, Chrome]](https://bugbountylibrary.com/r/h1%3A470553) — palant