CVE-2022-47636
📋 TL;DR
This CVE describes a DLL hijacking vulnerability in OutSystems Service Studio 11. When users open .oml files, the application loads specific DLLs from the same directory, allowing attackers to execute arbitrary code by placing malicious DLLs there. This affects users of OutSystems Service Studio 11 who open untrusted .oml files.
💻 Affected Systems
- OutSystems Service Studio
📦 What is this software?
Service Studio by Outsystems
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise of the logged-in user account, allowing attackers to install malware, steal credentials, and move laterally within the network.
Likely Case
Local privilege escalation leading to data theft, persistence establishment, or ransomware deployment on the affected workstation.
If Mitigated
Limited impact with proper user training and file handling procedures, potentially only affecting isolated systems.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious .oml file. Public exploit code exists on Exploit-DB and Packet Storm.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
Check OutSystems official security advisories for patch availability. Update to latest version if patch exists.
🔧 Temporary Workarounds
Restrict .oml file handling
windowsConfigure Windows to open .oml files with a different application or block execution from untrusted locations.
Implement DLL search order hardening
windowsUse Windows policies to restrict DLL loading from current directory.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0x1 /f
🧯 If You Can't Patch
- Train users to never open .oml files from untrusted sources or network shares.
- Implement application whitelisting to prevent execution of unauthorized DLLs.
🔍 How to Verify
Check if Vulnerable:
Check if OutSystems Service Studio version is 11.53.30 build 61739. Test by placing a test DLL in same directory as .oml file and monitoring loading behavior.Check Version:
Check application About dialog or installation directory version information.Verify Fix Applied:
Verify updated version number and test DLL hijacking with controlled test files.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual locations
- Process Monitor logs showing DLL loading from current directory
Network Indicators:
- Unusual outbound connections from OutSystems Service Studio process
SIEM Query:
Process creation where parent process is OutSystems Service Studio and command line contains .oml file path from suspicious locations