CVE-2021-20726
📋 TL;DR
This is a DLL hijacking vulnerability in Overwolf's installer that allows attackers to execute arbitrary code with user privileges by placing a malicious DLL in a directory searched by the installer. It affects users running Overwolf installer version 2.168.0.n or earlier. The vulnerability requires the attacker to trick the user into running the installer from a compromised location.
💻 Affected Systems
- Overwolf
📦 What is this software?
Overwolf by Overwolf
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation to SYSTEM if the installer is run with elevated privileges, leading to complete control of the affected system.
Likely Case
Local privilege escalation allowing execution of arbitrary code with the user's permissions, potentially leading to data theft, malware installation, or lateral movement.
If Mitigated
Limited impact if users only run installers from trusted sources and with minimal privileges, though the vulnerability still exists in the software.
🎯 Exploit Status
Exploitation requires social engineering to get users to run the installer from a malicious location. The DLL hijacking technique is well-known and relatively simple to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.168.0.n
Vendor Advisory: https://www.overwolf.com/
Restart Required: No
Instructions:
1. Update Overwolf to the latest version. 2. If using an older installer, download the latest installer from the official Overwolf website. 3. Run the updated installer to complete the installation.
🔧 Temporary Workarounds
Safe Installation Practices
windowsOnly run the Overwolf installer from trusted locations like the official download directory
DLL Search Path Hardening
windowsUse Windows policies to restrict DLL search paths for applications
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
🧯 If You Can't Patch
- Restrict user permissions to prevent execution of installers from untrusted directories
- Implement application whitelisting to only allow execution of verified Overwolf installers
🔍 How to Verify
Check if Vulnerable:
Check Overwolf installer version - if it's 2.168.0.n or earlier, the system is vulnerableCheck Version:
Check the installer filename or properties for version informationVerify Fix Applied:
Verify Overwolf is updated to a version after 2.168.0.n by checking the version in the application or installer📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual directories during installer execution
- Process creation events for Overwolf installer from non-standard locations
Network Indicators:
- Unusual network connections originating from installer process
SIEM Query:
Process Creation where (Image contains 'Overwolf' OR ParentImage contains 'Overwolf') AND CommandLine contains 'install'