CVE-2023-28260
📋 TL;DR
CVE-2023-28260 is a .NET DLL hijacking vulnerability that allows attackers to execute arbitrary code by placing malicious DLLs in specific directories. This affects .NET applications running on Windows systems where attackers can write to application directories or influence DLL search paths.
💻 Affected Systems
- .NET Framework
- .NET Core
- .NET 5+
- ASP.NET applications
📦 What is this software?
.net by Microsoft
.net by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Local privilege escalation or remote code execution in environments where attackers can write to application directories, potentially leading to data theft or malware installation.
If Mitigated
Limited impact with proper file permissions, application isolation, and security controls preventing unauthorized file writes to application directories.
🎯 Exploit Status
Exploitation requires the ability to write files to specific directories that the application searches for DLLs. This often requires some level of initial access or misconfigured permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers and versions
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260
Restart Required: Yes
Instructions:
1. Apply the latest security updates from Windows Update. 2. For .NET Framework, install the appropriate KB update. 3. For .NET Core/5+, update to the latest patched version. 4. Restart affected systems and applications.
🔧 Temporary Workarounds
Restrict DLL search path
windowsConfigure applications to use safe DLL search order or specify full paths for DLL loading
Set DLL search path via SetDllDirectory API or application configuration
File permission hardening
windowsRestrict write permissions on application directories to prevent unauthorized DLL placement
icacls "C:\Program Files\YourApp" /deny Users:(OI)(CI)W
icacls "C:\Program Files\YourApp" /deny Everyone:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict file system permissions on application directories to prevent unauthorized writes
- Use application whitelisting to prevent execution of unauthorized DLLs
🔍 How to Verify
Check if Vulnerable:
Check if your .NET version is affected using: wmic product get name,version | findstr /i .NETCheck Version:
wmic product get name,version | findstr /i .NETVerify Fix Applied:
Verify installed updates via: wmic qfe list | findstr KBXXXXXX (replace with relevant KB number)📡 Detection & Monitoring
Log Indicators:
- Unusual DLL loads from unexpected locations
- File creation events in application directories
- Process creation from DLL loads
Network Indicators:
- Unusual outbound connections from .NET applications
- Command and control traffic following DLL execution
SIEM Query:
EventID=4688 OR EventID=4689 with process creation from DLLs in application directories