Win11-OneDrive-DLL-injection-vulnerability

KO | EN

gitlite — search

#hacktoberfest #react #llm #deep-learning #linux #macos #nodejs #java #windows #awesome #cli #kubernetes #awesome-list #ios

Win11-OneDrive-DLL-injection-vulnerability

(★ 22)

OneDrive, operating on Microsoft Windows 11 Pro is vulnerable to DLL hijacking.

Win11-OneDrive-DLL-injection-vulnerability 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Windows 11 OneDrive DLL hijacking

Wednesday, November 08, 2023.

## Summary
OneDrive, operating on Microsoft Windows 11 Pro is vulnerable to DLL hijacking.
As OneDrive operates with the privileges of the currently logged-in user, an attacker can exploit this vulnerability to run arbitrary code within the security context of the victim.

|                        |                                                    |
|------------------------|----------------------------------------------------|
|Product and version:    |Microsoft Windows 11 Pro [Version 10.0.22631.2506]  |
|Security Classification:|Elevation of Privilege via DLL hijacking, persistant|
|Target:                 |Local computer, all users                           |

Upon launch, OneDrive scans the directories listed in the PATH environment variable for two specific DLLs:

• Microsoft.UI.Xaml.XamlTypeInfo.dll
    • Microsoft.UI.Xaml.Controls.dll
    
Should an attacker manage to insert a malicious DLL, named identically to the above-mentioned DLLs, into any of the directories within the PATH, OneDrive will load and execute the code from the malicious DLL with the permissions of the currently logged-in user. The success of placing a malicious DLL into any folder listed in the PATH variable hinges on the permissions set for that particular folder.
This vulnerability is persistent and affects any user who logs into the computer.

## Root cause
The root cause of this issue is that the DLL safe search order is not enforced, leading the application to search for missing DLLs in folders listed in the PATH variable. The current DLL search order for OneDrive is:

• The directory from which the application loaded.
    • The system directory.
    • The 16-bit system directory.
    • The Windows directory.
    • The current directory.
    • The directories listed in the PATH environment variable.

## Proof of concept
To exploit this vulnerability, the following steps were taken:

• Confirm that OneDrive searches for DLLs outside the safe search order.
    • Identify a folder listed in the PATH variable that permits write access by a malicious user.
    • Plant a malicious DLL named either Microsoft.UI.Xaml.XamlTypeInfo.dll or Microsoft.UI.Xaml.Controls.dll into the folder.
    • Await another user logging in or launching OneDrive, which will execute the malicious DLL under their user privileges.

Contents of the PATH environment variable:

![path](https://github.com/ras-it/Win11-OneDrive-DLL-injection-vulnerability/blob/main/path.jpg?raw=true)

Sysinternals Procmon revealed that OneDrive searches for DLLs in PATH-enlisted folders using the privileges of the currently logged-in user (“win11pro\Korisnik”):

![procmon](https://github.com/ras-it/Win11-OneDrive-DLL-injection-vulnerability/blob/main/procmon.jpg?raw-true)

A malicious DLL named “Microsoft.UI.Xaml.Controls.dll” was placed in the C:\Hijack folder and loaded when any user logs onto the computer, resulting in code execution:

![pwn3d](https://github.com/ras-it/Win11-OneDrive-DLL-injection-vulnerability/blob/main/pwn3d.jpg?raw-true)

As shown in the attached image, the DLL was loaded by the OneDrive process under the privileges of the currently logged-in user:

![procexp](https://github.com/ras-it/Win11-OneDrive-DLL-injection-vulnerability/blob/main/procexp.jpg?raw-true)

### MSRC

MSRC does not consider PATH DLL injection a vulnerability; it is by design
https://msrc.microsoft.com/blog/2018/04/triaging-a-dll-planting-vulnerability/

Win11-OneDrive-DLL-injection-vulnerability

Win11-OneDrive-DLL-injection-vulnerability 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Win11-OneDrive-DLL-injection-vulnerability

Win11-OneDrive-DLL-injection-vulnerability 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README