# Unauthorized command execution in Web protection component of Anti-Virus products family [FF, Chrome]

Kaspersky Protect extension posts the avp.exe command interface location via unrestricted window.postMessage to the URL Advisor frame, letting any webpage hijack it and disable protections.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-24
- CVE: CVE-2019-15685
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/470553
- Library page: https://bugbountylibrary.com/r/h1%3A470553
- Tags: area:os domain:browser impact:integrity impact:internal-access kind:bounty platform:hackerone sev:medium tech:chromium tech:firefox technique:source-review vuln:command-injection vuln:misconfiguration

**Target:** Kaspersky Protect browser extension (Firefox/Chrome) URL Advisor frame and avp.exe command interface
**Root cause:** The URL Advisor frame receives data via window.postMessage() without restricting targetOrigin, so a page can swap the frame for its own and intercept the message containing the command interface location.
**Steps:**
1. Enable Anti-Banner and Private Browsing in Kaspersky settings.
2. Run the provided `ssl_server.py` HTTPS server on `https://localhost:5000/` and host `disable_features3.html`.
3. Add `127.0.0.1 www.google.example.com` to the hosts file so URL Advisor applies (host must start with `www.google.`).
4. Ensure Kaspersky Protect extension is enabled.
5. Browse to `https://www.google.example.com:5000/disable_features3.html` and accept the invalid cert.
6. Observe Anti-Banner and Private Browsing are now disabled.
**How found:** Prior reports (470544/470547) showed extension isolation issues; researcher checked whether the URL Advisor frame messaging was origin-restricted and found postMessage lacked targetOrigin, then tested frame replacement to intercept it.
**Exploitation:** Attacker page replaces the URL Advisor iframe with its own content, intercepts the unrestricted postMessage containing the command interface location, then issues commands to avp.exe to disable Anti-Banner/Private Browsing, add blocklist URLs, etc.
**Escalation:** Exposing avp.exe's internal processing to the web could turn bugs there into RCE running as SYSTEM (not explored).
**Insight:** When an extension injects an iframe and messages it, check whether postMessage sets targetOrigin and whether the frame can be swapped by the page; the leaked secret (here the local command interface URL) is the pivot to privileged native APIs.

## Write-ups of the same bug (oldest first)
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [IE]](https://bugbountylibrary.com/r/h1%3A470547) — palant
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family](https://bugbountylibrary.com/r/h1%3A470544) — palant
- 2019-11-24: [Unauthorized command execution in Web protection component of Anti-Virus products family [FF, Chrome]](https://bugbountylibrary.com/r/h1%3A470553) — palant (this one)