EUVD-2024-54619CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
AnalysisAI
DLL hijacking vulnerability in Yandex Telemost for Desktop versions before 2.7.0, where the application searches for dynamic libraries in untrusted paths, allowing local attackers with user-level privileges to execute arbitrary code through malicious DLL injection. The vulnerability has a high CVSS score of 7.8 and requires user interaction (running the application), but poses significant risk as DLL hijacking is a well-understood and commonly exploitable attack vector with publicly available proof-of-concept techniques.
Technical ContextAI
This vulnerability exploits CWE-426 (Untrusted Search Path), a well-documented weakness where applications load dynamic libraries (DLLs on Windows) from directories that an attacker can control or manipulate. Yandex Telemost for Desktop fails to use secure library loading practices (such as absolute paths, SetDllDirectory restrictions, or proper PATH environment isolation). When the application initializes, Windows DLL search order follows a predictable sequence: the application's directory, system directories, and then user-controlled PATH entries. By placing a maliciously crafted DLL in a location the application searches before legitimate system directories, an attacker can achieve code execution in the context of the Telemost process. This is a local privilege escalation technique commonly paired with social engineering or physical access scenarios.
RemediationAI
patch: Upgrade Yandex Telemost for Desktop to version 2.7.0 or later; priority: immediate; details: Version 2.7.0 addresses the untrusted search path issue by implementing secure DLL loading practices workaround: Restrict write permissions to directories in the Telemost installation path and user profile directories; details: Prevent attackers from placing malicious DLLs by enforcing strict NTFS permissions (deny write access to %APPDATA%, %TEMP%, and application directories for non-administrative users) mitigation: Monitor DLL load events using Windows Event Tracing or EDR solutions; details: Detect suspicious DLL loading patterns (e.g., unsigned DLLs loaded by Telemost) to identify exploitation attempts in progress environment_hardening: Remove or control user-writable directories from the system PATH environment variable; details: Ensure the current directory (.) is not in PATH, and audit PATH entries for world-writable locations
Share
External POC / Exploit Code
Leaving vuln.today