CVE-2023-53875
📋 TL;DR
GOM Player 2.3.90.5360 contains a remote code execution vulnerability in its Internet Explorer component that allows attackers to execute arbitrary code on victim systems. Attackers can exploit this via DNS spoofing and malicious URL shortcuts to deliver reverse shells through SMB interactions. This affects users running the vulnerable version of GOM Player on Windows systems.
💻 Affected Systems
- GOM Player
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Attacker executes malicious code to steal credentials, install backdoors, or deploy malware on individual user systems.
If Mitigated
Limited impact with proper network segmentation, endpoint protection, and user awareness preventing successful exploitation.
🎯 Exploit Status
Exploit requires DNS spoofing capability and user interaction with malicious shortcut. WebDAV and SMB techniques are used for payload delivery.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor website for latest version
Vendor Advisory: https://www.gomlab.com/
Restart Required: Yes
Instructions:
1. Visit https://www.gomlab.com/
2. Download latest version of GOM Player
3. Uninstall current version
4. Install updated version
5. Restart system
🔧 Temporary Workarounds
Disable Internet Explorer Integration
windowsRemove or disable the Internet Explorer component integration in GOM Player settings
Block SMB Outbound Connections
windowsUse firewall rules to block outbound SMB connections from user workstations
New-NetFirewallRule -DisplayName "Block SMB Outbound" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block
🧯 If You Can't Patch
- Uninstall GOM Player completely from affected systems
- Implement network segmentation to isolate vulnerable systems and block SMB traffic
🔍 How to Verify
Check if Vulnerable:
Check GOM Player version in Help > About. If version is 2.3.90.5360, system is vulnerable.Check Version:
Check Help > About in GOM Player interface or examine installed programs in Control PanelVerify Fix Applied:
Verify GOM Player version is updated to a version later than 2.3.90.5360📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from GOM Player or Internet Explorer
- SMB connection attempts from user workstations to unknown external IPs
- WebDAV protocol usage from GOM Player processes
Network Indicators:
- DNS requests for suspicious domains from GOM Player
- Outbound SMB connections on port 445 from workstations
- WebDAV traffic patterns
SIEM Query:
Process Creation where Parent Process contains "gom" OR Process contains "iexplore" AND Destination Port = 445