Untrusted Search Path in ventoy/ventoy
Reported on
Mar 8th 2022
Description
A current working directory type of DLL hijacking vulnerability is found in all executbales in ventoy-1.0.70-windows.zip, including:
- Ventoy2Disk.exe
- VentoyPlugson.exe
- VentoyVlnk.exe
Proof of Concept
Step 1 : Craft a malicious x86 dll named as "TextShaping.dll" and place in the same directory of the executable
Step 2: Double click the executable
The malicious dll should have been loaded and a cmd shell with admin privilege will be prompted since those executables required admin privilege by design. (*cmd shell can be obtained is due to the payload the execute cmd in malicious DLL)
Impact
This vulnerability is capable of letting attacker to do arbitrary code execution and even privilege escalation.
SECURITY.md
2 years ago
Thanks for the report. I'm not good at windows programming, how to fix such problem?
Desktop applications can control the location from which a DLL is loaded by specifying a full path, using DLL redirection, or by using a manifest. If none of these methods are used, the system searches for the DLL at load time as described in this section.
https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection https://docs.microsoft.com/en-us/windows/win32/sbscs/manifests
https://github.com/jfmaes/CMDLL
You may compile a x86 DLL and name it (it will spawn a cmd.exe as PoC), let me know if you cant do it and I can share you the dll via email.
Please test with this CI release: https://github.com/ventoy/Ventoy/actions/runs/2095286739
The latest Ventoy 1.0.73 release has fixed it. https://github.com/ventoy/Ventoy/releases/tag/v1.0.73
@ventoy - are you able to mark as fixed using the drop-down below?