CVE-2021-42923
📋 TL;DR
ShowMyPC 3606 on Windows has a DLL hijack vulnerability where attackers can place malicious code in a specific temporary directory file (wodVPN.dll) that the application loads. When ShowMyPC runs, it executes this malicious code with the user's privileges. This affects Windows users running ShowMyPC 3606.
💻 Affected Systems
- ShowMyPC
📦 What is this software?
Showmypc by Showmypc
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise if user runs ShowMyPC as administrator, allowing privilege escalation and complete control of the system.
Likely Case
Malicious code execution with user privileges, potentially leading to data theft, persistence mechanisms, or lateral movement within the network.
If Mitigated
Limited impact if user runs with minimal privileges and proper endpoint security blocks malicious DLL execution.
🎯 Exploit Status
Exploitation requires ability to write to %temp%\ShowMyPC\-ShowMyPC3606\ directory. DLL hijacking is well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://showmypc.com
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict Write Permissions
windowsSet restrictive permissions on the vulnerable directory to prevent unauthorized DLL placement.
icacls "%temp%\ShowMyPC\-ShowMyPC3606" /deny Everyone:(OI)(CI)(W)
Application Whitelisting
windowsImplement application control policies to prevent execution of unauthorized DLLs from temporary directories.
🧯 If You Can't Patch
- Run ShowMyPC with minimal user privileges (never as administrator)
- Monitor for suspicious DLL creation in %temp%\ShowMyPC\-ShowMyPC3606\ directory
🔍 How to Verify
Check if Vulnerable:
Check if ShowMyPC 3606 is installed and if %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll exists or can be written to.Check Version:
Check ShowMyPC about dialog or installed programs list for version 3606Verify Fix Applied:
Verify directory permissions prevent unauthorized writes or that newer version without vulnerability is installed.📡 Detection & Monitoring
Log Indicators:
- Process creation events for ShowMyPC loading DLLs from temporary directories
- File creation events in %temp%\ShowMyPC\-ShowMyPC3606\
Network Indicators:
- Unusual outbound connections from ShowMyPC process
SIEM Query:
Process Creation where Image contains 'ShowMyPC' and CommandLine contains 'wodVPN.dll' OR File Creation where TargetFilename contains 'ShowMyPC\\-ShowMyPC3606\\wodVPN.dll'