CVE-2021-26608
📋 TL;DR
This vulnerability in handysoft Co., Ltd groupware ActiveX module allows attackers to download and execute arbitrary files on affected systems. It affects users running the vulnerable ActiveX control in Internet Explorer. The issue stems from missing integrity checks for download URLs and file hashes.
💻 Affected Systems
- handysoft Co., Ltd groupware ActiveX module
📦 What is this software?
Hshell by Handysoft
Hshell by Handysoft
Hshell by Handysoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, allowing attackers to install malware, steal data, or create persistent backdoors.
Likely Case
Malware deployment leading to data theft, ransomware infection, or system disruption.
If Mitigated
Limited impact if ActiveX controls are disabled or proper network segmentation prevents exploitation.
🎯 Exploit Status
Exploitation requires user to visit malicious website but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36239
Restart Required: Yes
Instructions:
1. Visit vendor advisory URL
2. Download latest version of groupware software
3. Install update following vendor instructions
4. Restart system
🔧 Temporary Workarounds
Disable ActiveX in Internet Explorer
windowsPrevents exploitation by disabling the vulnerable control
Internet Options → Security tab → Custom Level → Disable ActiveX controls and plug-ins
Use alternative browser
windowsSwitch to browsers not supporting ActiveX (Chrome, Firefox, Edge)
🧯 If You Can't Patch
- Block Internet Explorer usage via group policy
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check if HShell.dll ActiveX control is registered and version matches vulnerable rangeCheck Version:
reg query HKLM\Software\Classes\CLSID\{HShell_CLSID} /v VersionVerify Fix Applied:
Verify ActiveX control version matches patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Internet Explorer processes downloading unusual files
- Execution of unexpected executables from temp directories
Network Indicators:
- HTTP requests to unusual domains from IE processes
- Downloads of executable files via ActiveX
SIEM Query:
process_name:iexplore.exe AND (file_create:*\temp\*.exe OR network_destination:unusual_domain)