CVE-2023-6235
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on systems running Duet Display version 2.5.9.1 by placing a malicious DLL in a specific directory. The uncontrolled search path element enables privilege escalation and persistence. Only users of the affected Duet Display version are impacted.
💻 Affected Systems
- Duet Display
📦 What is this software?
Duet Display by Duetdisplay
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining persistent administrative access, data theft, and lateral movement capabilities.
Likely Case
Local privilege escalation leading to malware installation, data exfiltration, or ransomware deployment.
If Mitigated
Limited impact with proper file permissions and monitoring preventing DLL placement in the vulnerable directory.
🎯 Exploit Status
Exploitation requires local access to place the malicious DLL file in the specific directory path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest version
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/arbitrary-code-execution-duet-display
Restart Required: Yes
Instructions:
1. Check Duet Display version
2. Update to latest version from official vendor
3. Restart system after update
🔧 Temporary Workarounds
Restrict WindowsApps directory permissions
windowsSet restrictive permissions on C:\Users\user\AppData\Local\Microsoft\WindowsApps\ to prevent unauthorized DLL placement
icacls "C:\Users\%USERNAME%\AppData\Local\Microsoft\WindowsApps" /deny Everyone:(OI)(CI)F
Remove vulnerable version
windowsUninstall Duet Display 2.5.9.1 until patched version is available
appwiz.cpl
🧯 If You Can't Patch
- Implement strict file integrity monitoring on WindowsApps directory
- Apply principle of least privilege to user accounts to limit DLL placement capability
🔍 How to Verify
Check if Vulnerable:
Check if Duet Display version 2.5.9.1 is installed and if libusk.dll can be placed in C:\Users\[username]\AppData\Local\Microsoft\WindowsApps\Check Version:
Check Duet Display application settings or Control Panel > Programs and FeaturesVerify Fix Applied:
Verify Duet Display is updated to version after 2.5.9.1 and test DLL placement in WindowsApps directory fails📡 Detection & Monitoring
Log Indicators:
- File creation events in C:\Users\*\AppData\Local\Microsoft\WindowsApps\
- Process execution of libusk.dll from unexpected locations
Network Indicators:
- Unusual outbound connections from Duet Display process
SIEM Query:
EventID=11 OR EventID=4688 WHERE TargetObject contains 'WindowsApps\\libusk.dll'