CVE-2022-29505
📋 TL;DR
A DLL injection vulnerability in LINE for Windows allows attackers to execute arbitrary code with elevated privileges. This affects LINE for Windows versions before 7.8 due to a build misconfiguration in the OpenSSL dependency. Users running vulnerable versions are at risk of privilege escalation attacks.
💻 Affected Systems
- LINE for Windows
📦 What is this software?
Line by Linecorp
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing attackers to install persistent malware, steal credentials, and access sensitive data.
Likely Case
Local privilege escalation enabling attackers to gain higher privileges than their current user account, potentially leading to lateral movement within the network.
If Mitigated
Limited impact if proper application control policies prevent unauthorized DLL loading and users operate with minimal privileges.
🎯 Exploit Status
Requires local access to place malicious DLL and trigger LINE to load it. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.8 and later
Vendor Advisory: https://hackerone.com/reports/1423049
Restart Required: Yes
Instructions:
1. Open LINE for Windows. 2. Go to Settings > About LINE. 3. Check version is 7.8 or higher. 4. If not, download latest version from official LINE website. 5. Install update and restart LINE.
🔧 Temporary Workarounds
Application Control Policy
windowsImplement application control policies to prevent unauthorized DLL loading from untrusted locations.
Use Windows AppLocker or similar to restrict DLL loading to trusted paths only
Remove Vulnerable Version
windowsUninstall vulnerable LINE versions and use web or mobile versions instead.
Control Panel > Programs > Uninstall LINE
🧯 If You Can't Patch
- Run LINE with minimal user privileges (not as administrator)
- Implement strict file system permissions to prevent DLL planting in LINE directories
🔍 How to Verify
Check if Vulnerable:
Open LINE, go to Settings > About LINE, check if version is below 7.8.Check Version:
Not applicable - check through LINE application interfaceVerify Fix Applied:
Confirm LINE version is 7.8 or higher in Settings > About LINE.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual locations by LINE process
- Process Monitor logs showing DLL injection attempts
Network Indicators:
- No network indicators - local attack only
SIEM Query:
Process Creation where Image contains 'LINE.exe' AND CommandLine contains 'dll' OR ParentImage contains 'LINE.exe'