3 ms·

I don’t have access to windows machine, but what does ‘full’ mean in the title? Like can it open outgoing network connections? Can load remote code?

tbrock 7y ago
The readme shows it runs as SYSTEM which means it can write to disk and make network calls, etc.
- pilif 7y ago
  well. the process that contains the JS engine can. The JS engine itself seems to be limited to what JS engines in browsers can normally do, so no intentional file system access. However as the README says, this is a custom built implementation, built by a company who believes running a JS engine with SYSTEM privileges is a good idea. This means that there are probably exploits available and those do get full access to the system as the highest privileged user.
  - TeMPOraL 7y ago
    And, let me guess - this JS scan is a part of their "web protection" stuff that runs on the websites you browse? Because that would mean attackers can drive-by exploit a lot of people with a bit of malicious script attached to an ad.
    - saagarjha 7y ago
      > That service loads the low level antivirus engine, and analyzes untrusted data received from sources like the filesystem minifilter or intercepted network traffic.
- makach 7y ago
  this can't be good for avast. I used them earlier but have stopped using them after seeing windows defender becoming better.
makach 7y ago
it's a valid question! From the github the author writes "Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage. Any vulnerabilities in this process are critical, and easily accessible to remote attackers."
numpad0 7y ago
I’d assume whether this runs escalated or not is considered not relevant
saagarjha 7y ago
I see strings for XMLHTTPRequest and this runs unsandboxed, so I'm not feeling too good about this.
gallexme 7y ago
That it uses a Javascript runtime to check for malicious Javascript code, which could be used to write malicious files which expect avast to scan it, then the anti-virus scans and if it thinks it's worth to interpret the Javascript, runs it to check what it does, if u escape that interpreter u can run code as basically the windows equilavent of root
- Gravyness 7y ago
  But... javascript never allowed computer files to be read? Or are you saying that also include NodeJS? What exactly can javascript do? Fetch data from the internet?
  - saagarjha 7y ago
    The JavaScript interpreter runs with SYSTEM privileges. A bug allowing for code execution would inherit those and thus be able to do a number of malicious things.
  - Godel_unicode 7y ago
    Have a UAF in the DOM code which allows a shellcode payload to run with SYSTEM.

tbrock 7y ago

The readme shows it runs as SYSTEM which means it can write to disk and make network calls, etc.

pilif 7y ago
well. the process that contains the JS engine can. The JS engine itself seems to be limited to what JS engines in browsers can normally do, so no intentional file system access. However as the README says, this is a custom built implementation, built by a company who believes running a JS engine with SYSTEM privileges is a good idea. This means that there are probably exploits available and those do get full access to the system as the highest privileged user.
- TeMPOraL 7y ago
  And, let me guess - this JS scan is a part of their "web protection" stuff that runs on the websites you browse? Because that would mean attackers can drive-by exploit a lot of people with a bit of malicious script attached to an ad.
  - saagarjha 7y ago
    > That service loads the low level antivirus engine, and analyzes untrusted data received from sources like the filesystem minifilter or intercepted network traffic.
makach 7y ago
this can't be good for avast. I used them earlier but have stopped using them after seeing windows defender becoming better.

makach 7y ago

it's a valid question! From the github the author writes "Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage. Any vulnerabilities in this process are critical, and easily accessible to remote attackers."

numpad0 7y ago

I’d assume whether this runs escalated or not is considered not relevant

saagarjha 7y ago

I see strings for XMLHTTPRequest and this runs unsandboxed, so I'm not feeling too good about this.

gallexme 7y ago

That it uses a Javascript runtime to check for malicious Javascript code, which could be used to write malicious files which expect avast to scan it, then the anti-virus scans and if it thinks it's worth to interpret the Javascript, runs it to check what it does, if u escape that interpreter u can run code as basically the windows equilavent of root

Gravyness 7y ago
But... javascript never allowed computer files to be read? Or are you saying that also include NodeJS? What exactly can javascript do? Fetch data from the internet?
- saagarjha 7y ago
  The JavaScript interpreter runs with SYSTEM privileges. A bug allowing for code execution would inherit those and thus be able to do a number of malicious things.
- Godel_unicode 7y ago
  Have a UAF in the DOM code which allows a shellcode payload to run with SYSTEM.