CVE-2024-20328

What it actually does

This is a local command injection flaw in ClamAV's VirusEvent feature. When VirusEvent is configured, ClamAV can execute a configured command after detecting malware. Vulnerable versions handle infected file names unsafely, allowing shell metacharacters or command-line sequences embedded in a file name to be interpreted as commands. Successful exploitation executes attacker-controlled commands with the privileges of the ClamAV application service account, commonly the clamav user but potentially a more privileged account depending on deployment.

Why it matters to the business

Systems that use ClamAV with VirusEvent enabled can allow a local or adjacent attacker who can place files for scanning to run commands on the scanner host. This can affect mail gateways, file-upload scanning services, shared file stores, CI/security scanning pipelines, and endpoint/server antivirus deployments. Consequences include tampering with scanned files, theft of data accessible to the ClamAV service account, disabling or evading security controls, staging malware, and using the scanner host as a pivot point. The CVSS score is moderate because local access is required, but the EPSS score is high, and the issue has been public for a long time, so exposed configurations should be treated as urgent even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains the ability to create or submit a file that will be scanned by ClamAV on a system where VirusEvent is configured. The attacker gives the file a name containing shell command syntax, such as separators, command substitution, or redirection characters, and ensures the file is detected as malicious, for example by using a known test signature or malware content. When ClamAV detects the file, the VirusEvent handler is invoked. In vulnerable versions, the unsafe file name is incorporated into command execution without sufficient neutralization, so the shell interprets part of the file name as attacker-supplied commands. Those commands run as the ClamAV service account. The attacker may then write files, exfiltrate readable data, spawn reverse shells if outbound connectivity is allowed, modify local scan workflows, or attempt privilege escalation if the service account has excessive permissions.

How to fix it

Upgrade ClamAV to a version containing the upstream fix. For source builds from cisco-talos/clamav, ensure the code includes commit 81ee14af95518106dcc6fc0c2c9f69165805df1b or a later commit. For packaged installations, install the vendor release that backports this fix and restart clamd or any scan services after upgrading. Because Cisco states there are no complete workarounds, patching is the required remediation. As temporary risk reduction only, disable or remove VirusEvent where it is not operationally required, restrict who can submit files to scanned locations, run ClamAV under a dedicated least-privilege account, prevent the ClamAV service account from writing to sensitive locations, and apply egress controls to reduce impact if command execution occurs.

How to confirm the fix worked

Confirm the installed ClamAV build is patched by checking package metadata, clamd --version output, vendor advisories, or source control state for commit 81ee14af95518106dcc6fc0c2c9f69165805df1b or later. Review clamd.conf and related configuration files for active VirusEvent directives. Verify clamd and scheduled scan jobs were restarted after patching. In a controlled non-production test, place a harmless detected test file with shell metacharacters in the filename into a scanned location and confirm no unintended shell command executes. Use EDR, auditd, or process accounting to confirm clamd or clamscan does not spawn unexpected shells or utilities when detections occur.

Typical attack path

1. Identify a host or workflow using ClamAV with the VirusEvent configuration option enabled.
2. Gain local ability to place or submit files into a directory, mailbox, upload area, share, or pipeline that ClamAV scans.
3. Create a file whose name contains command separators or command substitution syntax.
4. Make the file trigger a ClamAV detection, such as by embedding EICAR or other detectable content.
5. Wait for clamd, clamscan, or an automated scan job to process the file.
6. ClamAV invokes the configured VirusEvent command after detection.
7. The vulnerable command construction interprets the malicious file name as shell syntax.
8. Attacker-controlled commands execute with the privileges of the ClamAV service account.
9. Use the resulting access to persist, read or modify accessible data, disable controls, pivot, or attempt privilege escalation.

How to detect it

To determine whether this was already exploited, collect ClamAV logs, system logs, process creation telemetry, file upload/mail gateway logs, and audit records from systems using VirusEvent. Key sources include /var/log/clamav/clamav.log, /var/log/clamav/clamd.log, syslog, journald, auditd, EDR process trees, shell history for the ClamAV service account if present, web upload logs, mail attachment logs, and file share audit logs. Look for malware detection events followed immediately by unexpected child processes of clamd, clamscan, or scan wrapper scripts, especially /bin/sh, bash, dash, curl, wget, nc, ncat, python, perl, php, powershell, or chmod. Review detected filenames for command separators, command substitution, redirection, pipes, backticks, newline characters, or encoded equivalents. Correlate suspicious detections with outbound network connections, new files in temporary directories, modified scripts, cron/systemd persistence, or permission changes performed by the ClamAV service account. Also review the configured VirusEvent command to understand expected behavior and distinguish legitimate event-handler activity from unexpected command execution.

• VirusEvent
• /etc/clamav/clamd.conf
• /usr/local/etc/clamd.conf
• /var/log/clamav/clamav.log
• /var/log/clamav/clamd.log
• clamd
• clamscan
• parent_process_name=clamd
• parent_process_name=clamscan
• /bin/sh -c
• sh -c
• bash -c
• dash -c
• curl
• wget
• nc
• ncat
• python -c
• perl -e
• php -r
• chmod +x
• crontab -
• /tmp/
• /var/tmp/
• Eicar-Test-Signature
• FOUND
• ;
• &&
• ||
• |
• `
• $(

What your security team should do

• Inventory all ClamAV deployments, including mail gateways, file-upload services, shared file scanners, containers, and source-built installations.
• Prioritize systems with VirusEvent enabled and systems that scan files submitted by untrusted or semi-trusted users.
• Upgrade to a fixed build containing commit 81ee14af95518106dcc6fc0c2c9f69165805df1b or a vendor package that includes the fix.
• Restart ClamAV services and rescan configuration management to confirm vulnerable binaries are no longer running.
• Temporarily disable VirusEvent where business processes allow until patching is completed.
• Harden the ClamAV service account with least privilege, limited writable paths, no interactive login, and restricted outbound network access.
• Add detections for shells or scripting interpreters spawned by clamd, clamscan, or scan wrapper processes.
• Hunt historical ClamAV logs and process telemetry for suspicious filenames containing shell metacharacters near malware detection events.