CVE-2024-57394 Overview
CVE-2024-57394 affects the quarantine-restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0. The function permits an authenticated user to restore a quarantined file to an arbitrary file path on disk. Attackers can write a malicious Dynamic Link Library (DLL) into a system-controlled directory and trigger privilege escalation through Windows DLL hijacking. The flaw is categorized under [CWE-73] External Control of File Name or Path.
Critical Impact
Authenticated attackers can plant malicious DLLs in privileged system paths through the quarantine-restore workflow, achieving local privilege escalation on hosts running the affected endpoint security agent.
Affected Products
- Qi-ANXIN Tianqing Endpoint Security Management System v10.0
- Endpoints managed by the affected server version
- Windows hosts running the vulnerable agent component
Discovery Timeline
- 2025-04-21 - CVE-2024-57394 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-57394
Vulnerability Analysis
The quarantine-restore function fails to validate the destination path when restoring a previously quarantined file. An attacker with access to the quarantine management workflow can specify an arbitrary target path outside the intended quarantine or original-location directories. Because restored files retain their original contents, the attacker can supply a malicious payload that will be written verbatim to the chosen location. The restore operation is executed with the privileges of the endpoint security agent, which typically runs as a high-privilege service on Windows.
Root Cause
The root cause is improper external control of a file path parameter accepted by the restore function. The application trusts the caller-supplied destination path without enforcing an allow-list of valid restore locations. This maps directly to [CWE-73], where user input is used to construct filesystem paths without adequate validation or canonicalization.
Attack Vector
An authenticated attacker first submits or arranges for a malicious DLL to be placed into the quarantine store. The attacker then invokes the restore action and specifies a destination path corresponding to a directory searched by a privileged Windows process. When the target process next loads the hijacked DLL, the attacker's code executes in that process's security context. This chain achieves privilege escalation from the attacker's initial low-privilege session to SYSTEM or an equivalent service account. Refer to the GitHub PoC Repository for technical details.
Detection Methods for CVE-2024-57394
Indicators of Compromise
- Unexpected DLL files appearing in system directories such as C:\Windows\System32 or application install paths following quarantine-restore activity
- Audit records in the Tianqing management console showing restore operations with destination paths outside the original file location
- Privileged Windows services loading DLLs from paths recently modified by the endpoint agent process
- Anomalous child processes spawned by the Tianqing agent service shortly after a restore action
Detection Strategies
- Correlate quarantine-restore audit events with subsequent filesystem writes to sensitive Windows directories
- Alert on any restore operation whose destination path differs from the file's original quarantined origin path
- Monitor DLL load events for signed system binaries loading unsigned or newly written DLLs from non-standard locations
Monitoring Recommendations
- Enable Sysmon Event ID 7 (Image Loaded) and Event ID 11 (FileCreate) to track DLL placement and loading behavior
- Review Tianqing administrative logs for privilege changes and restore actions performed by non-administrative accounts
- Baseline expected DLL locations for critical services and alert on deviations
How to Mitigate CVE-2024-57394
Immediate Actions Required
- Restrict access to the Tianqing management console to trusted administrators only and audit existing account privileges
- Revoke restore permissions for accounts that do not require quarantine management functions
- Inventory all quarantined items and validate the integrity of files restored in recent management activity
- Contact Qi-ANXIN support to confirm patch availability for v10.0 deployments
Patch Information
No vendor advisory URL is published in the NVD entry for CVE-2024-57394 at the time of writing. Administrators should consult the Qianxin Product Detail page and contact Qi-ANXIN support directly to obtain remediation guidance and any available hotfixes for Tianqing Endpoint Security Management System v10.0.
Workarounds
- Disable or restrict the quarantine-restore feature at the policy level until a patch is deployed
- Apply strict role-based access control so only vetted administrators can perform restore operations
- Monitor Windows DLL search paths on managed endpoints and enforce Safe DLL Search Mode via Group Policy
- Deploy application control policies (Windows Defender Application Control or AppLocker) to block unsigned DLLs from loading in privileged processes
# Enforce Safe DLL Search Mode on managed Windows endpoints
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
# Audit restore-related events from the Tianqing agent service
wevtutil sl Security /e:true
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
