CVE-2024-1112
📋 TL;DR
A heap-based buffer overflow vulnerability in Resource Hacker version 3.6.0.92 allows attackers to execute arbitrary code by providing a specially crafted long filename argument. This affects users who process untrusted files with Resource Hacker, potentially leading to complete system compromise.
💻 Affected Systems
- Resource Hacker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to full system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or arbitrary code execution when processing malicious files, potentially leading to lateral movement within networks.
If Mitigated
Limited impact if application runs with minimal privileges and in isolated environments, though data corruption or denial of service may still occur.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files; no known public exploits at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.6.0.93 or later
Vendor Advisory: https://www.angusj.com/resourcehacker/
Restart Required: No
Instructions:
1. Download latest version from angusj.com/resourcehacker 2. Uninstall old version 3. Install new version 4. Verify version is 3.6.0.93 or higher
🔧 Temporary Workarounds
Restrict File Processing
windowsLimit Resource Hacker to only process trusted files from known sources
Run with Reduced Privileges
windowsExecute Resource Hacker with standard user privileges instead of administrator rights
🧯 If You Can't Patch
- Uninstall Resource Hacker completely if not required
- Implement application whitelisting to block Resource Hacker execution
🔍 How to Verify
Check if Vulnerable:
Check Resource Hacker version via Help > About; if version is 3.6.0.92, system is vulnerableCheck Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 3.6.0.93 or higher in Help > About dialog📡 Detection & Monitoring
Log Indicators:
- Process creation events for Resource Hacker with long command line arguments
- Application crashes of Resource Hacker
Network Indicators:
- Unusual outbound connections from Resource Hacker process
SIEM Query:
ProcessName="ResourceHacker.exe" AND (CommandLine CONTAINS "*" OR CommandLine LENGTH > 100)