That it uses a Javascript runtime to check for malicious Javascript code, which could be used to write malicious files which expect avast to scan it, then the anti-virus scans and if it thinks it's worth to interpret the Javascript, runs it to check what it does, if u escape that interpreter u can run code as basically the windows equilavent of root
But... javascript never allowed computer files to be read? Or are you saying that also include NodeJS? What exactly can javascript do? Fetch data from the internet?
The JavaScript interpreter runs with SYSTEM privileges. A bug allowing for code execution would inherit those and thus be able to do a number of malicious things.
it's a valid question! From the github the author writes "Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage. Any vulnerabilities in this process are critical, and easily accessible to remote attackers."
well. the process that contains the JS engine can. The JS engine itself seems to be limited to what JS engines in browsers can normally do, so no intentional file system access.
However as the README says, this is a custom built implementation, built by a company who believes running a JS engine with SYSTEM privileges is a good idea. This means that there are probably exploits available and those do get full access to the system as the highest privileged user.
And, let me guess - this JS scan is a part of their "web protection" stuff that runs on the websites you browse? Because that would mean attackers can drive-by exploit a lot of people with a bit of malicious script attached to an ad.
> That service loads the low level antivirus engine, and analyzes untrusted data received from sources like the filesystem minifilter or intercepted network traffic.
