Headline
CVE-2021-31637: UwAmp Arbitrary Code Execution
An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL.
Platform: Windows 10 version 1904
Impact: Arbitrary Code Execution and Privilege Escalation
Product: UwAmp.exe
Version: 3.0.2
Summary:
A malicous user can perform arbitrary code execution and priviledge escalation on victim machine by hijacking DLLs.
DLL Hijacking vulnerability occurs when some DLLs are missing from same directory of vulnerable binary.
Crafted Malicous DLLs are used to replace missing dlls and perform malicious actions
Missing DLL : shfolder.dll
Steps to reproduce:
1. Use ProcMon to listen on events
2. ProcMon shows shfolder.dll is missing from current directory
2. Place malicious DLL naming shfolder.dll to current directory of installer
3. Now run UwAmp.exe and installer will try to load malicous dll which leads to arbitrary code execution and privilege escalation.
Impact:
1. Privilege Escalation
2. Arbitrary Code Execution
Mitigation:
1. Avoid loading DLLs from current location