Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2024-5102 Overview
CVE-2024-5102 is a local privilege escalation vulnerability in Avast Antivirus for Windows versions prior to 24.2. The flaw resides in the Repair feature accessible through settings -> troubleshooting -> repair, which deletes files in the current user's AppData directory while running as NT AUTHORITY\SYSTEM. A low-privileged user can abuse this behavior with pseudo-symlinks and junction folders to delete arbitrary files or execute code with SYSTEM privileges. The vulnerability is tracked under [CWE-59] (link following) and [CWE-1284] (improper validation of specified quantity in input).
Critical Impact
Local attackers can elevate privileges from a standard user context to NT AUTHORITY\SYSTEM, enabling arbitrary file deletion and launch of privileged shell instances.
Affected Products
- Avast Antivirus versions prior to 24.2 on Windows
- Microsoft Windows (host operating system)
- Avast endpoints exposing the Repair/troubleshooting feature
Discovery Timeline
- 2024-06-10 - CVE-2024-5102 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5102
Vulnerability Analysis
The vulnerability is a symlink-based Time-of-Check Time-of-Use (TOCTOU) race condition in the Avast Antivirus Repair workflow. When a user triggers Repair, a SYSTEM-level process deletes and recreates files within the current user's AppData directory. Because the SYSTEM process does not validate whether the target paths are legitimate files, a low-privileged user can replace the expected paths with filesystem redirection primitives.
An attacker places a pseudo-symlink combined with an NTFS junction folder pointing to a protected location outside AppData. When Repair runs as SYSTEM, file operations follow the redirection and act on attacker-chosen targets. Winning the race allows the attacker to force Windows to call back into a crafted file, resulting in a privileged shell.
Root Cause
The root cause is improper handling of filesystem links [CWE-59] in a SYSTEM-privileged routine. The Repair function trusts user-controlled paths inside AppData and performs deletion and recreation without validating link targets or using opened handles with reparse-point protection.
Attack Vector
Exploitation requires local access, authenticated user privileges, and user interaction to trigger the Repair action. The attacker must stage junction folders and pseudo-symlinks under the user's AppData tree before invoking Repair, then win a race condition against the SYSTEM process. Successful exploitation redirects file operations to arbitrary paths and enables execution as NT AUTHORITY\SYSTEM.
No public proof-of-concept exploit code is available at the time of writing. Technical details are described in prose only; refer to the Norton Security Advisories for vendor documentation.
Detection Methods for CVE-2024-5102
Indicators of Compromise
- Creation of NTFS junction points or reparse points within %LOCALAPPDATA% or %APPDATA% by non-administrative users
- Unexpected file deletions in system directories correlated with Avast Repair activity
- Child processes of Avast service binaries spawning command shells such as cmd.exe or powershell.exe as NT AUTHORITY\SYSTEM
Detection Strategies
- Monitor for Sysmon Event ID 11 (FileCreate) and Event ID 2 (file creation time changes) involving reparse points in user-writable paths
- Alert on Avast service processes performing file writes or deletions outside expected product directories
- Correlate Repair feature invocation with subsequent SYSTEM-level process creation events
Monitoring Recommendations
- Enable Windows auditing of object access (Event IDs 4656, 4663) on sensitive system directories
- Deploy endpoint telemetry that captures reparse point creation and junction manipulation
- Track Avast Antivirus version inventory to confirm all endpoints run version 24.2 or later
How to Mitigate CVE-2024-5102
Immediate Actions Required
- Upgrade all Avast Antivirus installations on Windows to version 24.2 or later
- Restrict interactive logons on sensitive systems to reduce local attack surface
- Audit AppData directories for existing junction points or symbolic links created by low-privileged users
Patch Information
Avast addressed the vulnerability in Avast Antivirus version 24.2. Users should apply the vendor update through the product's built-in update mechanism or redeploy the latest installer. Refer to the Norton Security Advisories page for official vendor guidance.
Workarounds
- Avoid invoking the Repair function (settings -> troubleshooting -> repair) on unpatched installations
- Enforce standard-user policies that prevent creation of symbolic links by removing the SeCreateSymbolicLinkPrivilege right where not required
- Use application control to prevent unauthorized processes from spawning privileged shells
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
