CVE-2022-28128
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code with elevated privileges by placing a malicious DLL in a directory that AttacheCase searches when loading libraries. It affects users of AttacheCase version 3.6.1.0 and earlier on Windows systems.
💻 Affected Systems
- AttacheCase
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution with administrative privileges, leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain higher privileges on the system, potentially enabling further lateral movement or malware execution.
If Mitigated
Limited impact if proper access controls restrict DLL placement or if the software is run with minimal privileges, though exploitation risk remains.
🎯 Exploit Status
Exploitation requires the attacker to place a malicious DLL in a directory that AttacheCase searches, which may involve social engineering or local access; no public proof-of-concept has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.6.2.0 or later
Vendor Advisory: https://hibara.org/software/attachecase/?lang=en
Restart Required: Yes
Instructions:
1. Download the latest version from the official AttacheCase website. 2. Uninstall the old version. 3. Install the new version. 4. Restart the system to ensure changes take effect.
🔧 Temporary Workarounds
Restrict DLL search path
windowsModify the DLL search order to prioritize system directories over current directory, reducing risk of loading malicious DLLs.
Use Group Policy or registry settings to set SafeDllSearchMode to 1 (enabled) in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
Run with limited privileges
windowsExecute AttacheCase with non-administrative user accounts to limit the impact of privilege escalation.
🧯 If You Can't Patch
- Monitor and restrict write permissions to directories in the DLL search path to prevent unauthorized DLL placement.
- Use application whitelisting or antivirus software to block execution of unknown or malicious DLLs.
🔍 How to Verify
Check if Vulnerable:
Check the AttacheCase version by opening the software and navigating to Help > About; if version is 3.6.1.0 or earlier, it is vulnerable.Check Version:
attachecase.exe --version or check in Help > About menuVerify Fix Applied:
After updating, confirm the version is 3.6.2.0 or later via Help > About, and test that DLL loading from untrusted paths is blocked.📡 Detection & Monitoring
Log Indicators:
- Unexpected DLL load events from non-system directories in Windows Event Logs (e.g., Event ID 7 in Application logs).
Network Indicators:
- Unusual outbound connections from AttacheCase process post-exploitation, though exploitation is local.
SIEM Query:
EventID=7 AND ProcessName="attachecase.exe" AND ImageLoaded CONTAINS "user" OR "temp"