CVE-2018-25320 Overview
CVE-2018-25320 is an arbitrary code execution vulnerability in ACL Analytics versions 11.x through 13.0.0.579. The flaw resides in the application's EXECUTE function, which permits attackers to run arbitrary operating system commands. Adversaries can chain bitsadmin with PowerShell to download and execute malicious scripts under system privileges. Successful exploitation enables reverse shell establishment and full host compromise. The weakness is categorized under [CWE-94] Improper Control of Generation of Code (Code Injection).
Critical Impact
Attackers can achieve unauthenticated arbitrary code execution with system privileges, leading to complete host takeover through reverse shells deployed via bitsadmin and PowerShell.
Affected Products
- ACL Analytics 11.x
- ACL Analytics 12.x
- ACL Analytics through version 13.0.0.579
Discovery Timeline
- 2026-05-17 - CVE-2018-25320 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2018-25320
Vulnerability Analysis
The vulnerability stems from unsafe handling of the EXECUTE function exposed by ACL Analytics scripting. The function passes user-controlled input directly to a system command interpreter without validation or sanitization. Attackers leverage this primitive to invoke native Windows utilities such as bitsadmin.exe and powershell.exe. The combination allows staged payload delivery: bitsadmin retrieves a remote PowerShell script, and PowerShell executes it in-memory.
Because ACL Analytics often runs with elevated privileges to access audit data, executed commands inherit those rights. This produces a direct path from script-level injection to full system control without requiring memory corruption or privilege escalation primitives.
Root Cause
The root cause is improper neutralization of code constructs passed to the EXECUTE function [CWE-94]. The product treats scripted input as trusted and invokes the host operating system shell. No allowlisting, parameter binding, or command filtering exists between the analytics engine and the underlying OS interpreter.
Attack Vector
The attack vector is network-accessible through analytics scripts or projects opened by the application. An attacker crafts an ACL script that calls EXECUTE with a command string invoking bitsadmin /transfer to fetch a hosted PowerShell payload. The payload then opens a reverse shell back to attacker-controlled infrastructure. No authentication or user interaction beyond opening the malicious analytics project is required. Refer to the Exploit-DB #44281 entry and the VulnCheck Advisory for ACL Analytics for technical details.
Detection Methods for CVE-2018-25320
Indicators of Compromise
- ACL Analytics process (aclwin.exe or equivalent) spawning cmd.exe, powershell.exe, or bitsadmin.exe as child processes.
- Outbound bitsadmin /transfer jobs initiated from a host running ACL Analytics.
- PowerShell command lines containing IEX, DownloadString, or FromBase64String originating from the analytics process tree.
- Unexpected outbound TCP connections from ACL Analytics hosts to non-corporate IP ranges.
Detection Strategies
- Hunt for parent-child process anomalies where ACL Analytics binaries launch native Windows scripting or transfer utilities.
- Inspect ACL script files (.acl, .aclscript) for EXECUTE directives invoking shell binaries or remote download commands.
- Correlate file creation events in %TEMP% or %APPDATA% with subsequent PowerShell execution on analytics workstations.
Monitoring Recommendations
- Enable PowerShell ScriptBlock logging (Event ID 4104) and Module logging on hosts running ACL Analytics.
- Forward Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) to a centralized analytics platform.
- Alert on any bitsadmin.exe invocation by non-administrative user contexts.
How to Mitigate CVE-2018-25320
Immediate Actions Required
- Upgrade ACL Analytics to a version newer than 13.0.0.579 where the EXECUTE function behavior has been remediated.
- Restrict execution of ACL Analytics to vetted scripts and projects from trusted sources only.
- Remove or block bitsadmin.exe execution rights for standard users via application control policies.
- Segment ACL Analytics workstations from internet-facing networks where business requirements allow.
Patch Information
Review the VulnCheck Advisory for ACL Analytics and the ACL Analytics Product Page for vendor-supplied upgrade guidance. No specific vendor patch identifier is recorded in the NVD entry; administrators should contact the vendor for the current supported release.
Workarounds
- Disable or restrict use of the EXECUTE function through analytics project policy where the product supports it.
- Apply Windows Defender Application Control or AppLocker rules to block bitsadmin.exe and powershell.exe from spawning under the ACL Analytics process tree.
- Run ACL Analytics under a low-privilege service account to reduce blast radius of successful injection.
- Monitor and log all use of legacy Windows transfer utilities across the environment.
# Example AppLocker rule concept to block bitsadmin under ACL Analytics
# Deny: Path = %SYSTEM32%\bitsadmin.exe
# Condition: Parent process = aclwin.exe
# Apply to: All users on analytics workstations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
