CVE-2022-23410: Axis IP Utility RCE Vulnerability

CVE-2022-23410 Overview

CVE-2022-23410 is a DLL hijacking vulnerability affecting AXIS IP Utility before version 4.18.0. The vulnerability allows attackers to achieve remote code execution and local privilege escalation by placing a malicious DLL in the same directory as the IPUtility.exe executable. When the application launches, it attempts to load DLLs from its current working directory without proper validation, enabling the execution of attacker-controlled code with the privileges of the running process.

Critical Impact

Successful exploitation enables remote code execution and local privilege escalation, potentially allowing attackers to gain complete control over affected systems running AXIS IP Utility.

Affected Products

• AXIS IP Utility versions prior to 4.18.0
• Systems running IPUtility.exe from directories accessible to attackers

Discovery Timeline

• 2022-02-14 - CVE-2022-23410 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-23410

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), a weakness category that describes applications that search for critical resources using an externally controlled search path. The IPUtility.exe application fails to properly validate or specify the complete path for DLL dependencies, instead relying on the Windows DLL search order which includes the current working directory.

When a user executes IPUtility.exe from a directory containing a malicious DLL—such as when opening a file from a network share or download folder—Windows will load the attacker's DLL before legitimate system libraries. This occurs because Windows searches the application's current working directory before the system directories in its default DLL search order.

The vulnerability requires user interaction to trigger, specifically the user must execute the application from a directory where an attacker has placed a malicious DLL. This attack vector is commonly seen in scenarios where users open files from untrusted locations such as email attachments, network shares, or downloaded archives.

Root Cause

The root cause of this vulnerability lies in the application's failure to implement secure DLL loading practices. IPUtility.exe does not use absolute paths when loading required DLL dependencies, nor does it employ Windows API functions like SetDllDirectory("") to remove the current working directory from the search path. This design flaw allows the Windows loader to search for DLLs in potentially attacker-controlled locations.

Attack Vector

The attack requires local access to place a malicious DLL in a directory where the victim will execute AXIS IP Utility. Common attack scenarios include:

1. An attacker places a malicious DLL alongside a legitimate file in a shared network folder or download location
2. The victim navigates to this location and executes IPUtility.exe or opens a file that triggers the application
3. Windows loads the malicious DLL from the current working directory
4. The attacker's code executes with the privileges of the user running the application, potentially leading to full system compromise if the user has administrative privileges

The vulnerability exploits the Windows DLL search order mechanism where applications that don't specify absolute paths for their DLL dependencies will search the current working directory, creating an opportunity for DLL hijacking attacks.

Detection Methods for CVE-2022-23410

Indicators of Compromise

• Unexpected DLL files appearing in directories alongside AXIS IP Utility or in user download folders
• DLL files with names matching common Windows system libraries located outside of %SystemRoot%\System32
• Process creation events showing IPUtility.exe loading DLLs from unusual locations
• Suspicious child processes spawned from IPUtility.exe

Detection Strategies

• Monitor for DLL loading events from IPUtility.exe where the DLL path does not match expected system directories
• Deploy endpoint detection rules to alert on DLL side-loading patterns associated with this application
• Implement file integrity monitoring on directories commonly used for DLL hijacking attacks
• Use application allowlisting to prevent unauthorized DLLs from being loaded

Monitoring Recommendations

• Enable Windows Sysmon logging with configuration to capture ImageLoad events (Event ID 7) for IPUtility.exe
• Monitor process creation logs for any child processes spawned from IPUtility.exe
• Review security logs for privilege escalation attempts following AXIS IP Utility execution
• Implement network monitoring for unusual outbound connections from the AXIS IP Utility process

How to Mitigate CVE-2022-23410

Immediate Actions Required

• Update AXIS IP Utility to version 4.18.0 or later immediately
• Audit systems for vulnerable versions of AXIS IP Utility and prioritize remediation
• Ensure users do not run AXIS IP Utility from untrusted directories such as download folders or network shares
• Review recent DLL files created in user-accessible directories for potential malicious content

Patch Information

Axis has released version 4.18.0 of the IP Utility which addresses this vulnerability. Organizations should download the updated version from official Axis distribution channels. For detailed information about the security fix, refer to the Axis Security Advisory CVE-2022-23410.

Workarounds

• Configure Windows Defender Application Control (WDAC) or AppLocker policies to prevent unauthorized DLL loading
• Run AXIS IP Utility only from its default installation directory, never from download folders or network locations
• Deploy SentinelOne Singularity Platform to detect and prevent DLL hijacking attempts in real-time
• Remove write permissions from directories where AXIS IP Utility is commonly executed
• Educate users about the risks of running applications from untrusted locations

Organizations using SentinelOne can leverage the platform's behavioral AI engine to detect DLL hijacking attempts, including those targeting AXIS IP Utility. The Singularity Platform provides real-time protection against DLL side-loading attacks by monitoring process behavior and DLL loading patterns.