CVE-2024-20328: 
Clam AntiVirus vulnerability analysis and mitigation

A command injection vulnerability (CVE-2024-20328) was discovered in ClamAV's VirusEvent feature. The vulnerability affects multiple versions of ClamAV ranging from 0.104 through 1.2.1, including all patch versions and LTS releases. The flaw allows local attackers to inject arbitrary commands with the privileges of the application service account (ClamAV Blog, NVD).

The vulnerability stems from unsafe handling of file names in the VirusEvent feature of ClamAV's ClamD service. The issue occurs when processing the '%f' format string parameter in the VirusEvent configuration, which fails to properly sanitize file names. When the VirusEvent feature is configured in clamd.conf, an attacker can exploit this by supplying a file name containing command-line sequences that get executed through the '/bin/sh' shell. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (SecurityOnline, AttackerKB).

When successfully exploited, this vulnerability allows attackers to execute arbitrary commands with the privileges of the ClamAV service account. This is particularly concerning in environments where ClamAV runs with elevated privileges, such as mail servers where it's commonly used to scan files. The impact is heightened when ClamAV's daemon (clamd) runs as root (SecurityOnline).

The vulnerability requires local access and is exploitable when the VirusEvent feature is configured in ClamAV's configuration. A proof-of-concept (PoC) has been published demonstrating how an attacker can craft a malicious file name to trigger command execution. The vulnerability was discovered by security researcher Amit Schendel (SecurityOnline).

ClamAV has released security updates to address this vulnerability in versions 1.2.2 and 1.0.5. The fix involves disabling the '%f' format string parameter in the VirusEvent feature. Administrators can continue to use the CLAM_VIRUSEVENT_FILENAME environment variable instead of '%f', but only from within an executable like a Python script, and not directly in the clamd.conf VirusEvent command (ClamAV Blog).