Process control via user-controlled native library load or DLL search path

ID

vbnet.inject.process_control

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into a native/unmanaged library load (NativeLibrary.Load, P/Invoke LoadLibrary/LoadLibraryEx) or into a change of the DLL search path (SetDllDirectory/AddDllDirectory). An attacker who controls the library name or the search directory can force the process to load an attacker-supplied DLL and execute arbitrary code (process control). Load only fixed, fully-qualified libraries from a trusted location, and never derive the library name or search path from untrusted input.

Rationale

User-controlled input flows into a native/unmanaged library load (NativeLibrary.Load, P/Invoke LoadLibrary/LoadLibraryEx) or into a change of the DLL search path (SetDllDirectory/AddDllDirectory). An attacker who controls the library name or the search directory can force the process to load an attacker-supplied DLL and execute arbitrary code (process control). Load only fixed, fully-qualified libraries from a trusted location, and never derive the library name or search path from untrusted input.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub LoadFromQueryString(Request As HttpRequest)
    Dim libName As String = Request.QueryString("lib")
    ' VULNERABLE: Process control via user-controlled native library load or DLL search path
    NativeLibrary.Load(libName)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References