CVE-2022-23748: Dante Application Library DLL Sideloading

CVE-2022-23748 Overview

CVE-2022-23748 is a DLL Sideloading vulnerability affecting the mDNSResponder.exe component in the Audinate Dante Application Library. The executable improperly specifies how to load DLL files, including from which folder and under what conditions. This insecure DLL loading behavior allows a malicious attacker to leverage the valid and legitimate executable to load malicious files, potentially leading to code execution in the context of the vulnerable application.

This vulnerability is particularly concerning as it has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, making immediate remediation a priority for affected organizations.

Critical Impact

Attackers can abuse the legitimate mDNSResponder.exe to load malicious DLLs, enabling local code execution with potential for privilege escalation, data theft, and persistent access. This vulnerability is actively exploited in the wild.

Affected Products

• Audinate Dante Application Library
• Microsoft Windows (as the underlying operating system platform)
• Systems utilizing mDNSResponder.exe from Dante Discovery

Discovery Timeline

• 2022-11-17 - CVE-2022-23748 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2022-23748

Vulnerability Analysis

This DLL Sideloading vulnerability exploits a fundamental weakness in how Windows applications locate and load dynamic-link libraries. When mDNSResponder.exe executes, it attempts to load certain DLL files without properly specifying the absolute path or implementing secure loading conditions. This creates an opportunity for attackers to place a malicious DLL in a location that will be searched before the legitimate DLL directory.

The vulnerability is classified under CWE-114 (Process Control) and CWE-426 (Untrusted Search Path), both of which relate to insufficient control over the execution environment and improper handling of external resources. The local attack vector requires user interaction, typically through social engineering techniques that convince a user to execute the vulnerable application from a directory containing a malicious DLL.

Root Cause

The root cause stems from improper DLL search order implementation in mDNSResponder.exe. The application fails to:

1. Specify absolute paths for required DLL dependencies
2. Implement secure DLL loading flags such as LOAD_LIBRARY_SEARCH_SYSTEM32
3. Validate the integrity or source of loaded libraries
4. Restrict DLL loading to trusted directories only

This allows the Windows DLL search order mechanism to potentially load a malicious DLL placed in the application's working directory or other locations searched before the intended system directories.

Attack Vector

The attack requires local access and user interaction to execute successfully. A typical attack scenario involves:

1. An attacker identifies a DLL that mDNSResponder.exe attempts to load without proper path specification
2. The attacker crafts a malicious DLL with the same name as the expected legitimate DLL
3. The malicious DLL is placed in a directory that will be searched before the legitimate DLL location (often the same directory as the executable or the current working directory)
4. When the user executes mDNSResponder.exe or an application that triggers its execution, the malicious DLL is loaded
5. Code within the malicious DLL executes with the same privileges as the vulnerable application

This attack technique is commonly used for persistence, privilege escalation, and defense evasion, as the malicious code runs under the guise of a legitimate, signed executable. For detailed technical analysis, refer to the Checkpoint Vulnerability CPRID-2193 security research.

Detection Methods for CVE-2022-23748

Indicators of Compromise

• Unexpected DLL files located in the same directory as mDNSResponder.exe or Dante application directories
• DLL files with legitimate Windows or Dante library names appearing in non-standard locations
• Process execution chains showing mDNSResponder.exe loading DLLs from user-writable directories
• Unsigned or suspiciously signed DLLs being loaded by mDNSResponder.exe

Detection Strategies

• Monitor for DLL load events from mDNSResponder.exe where the DLL path does not match expected system or application directories
• Implement application whitelisting to prevent unauthorized DLLs from loading
• Use endpoint detection and response (EDR) solutions to identify anomalous DLL sideloading behavior
• Create detection rules for common DLL hijacking patterns targeting audio/networking software

Monitoring Recommendations

• Enable detailed process creation and DLL loading audit logs via Windows Security Event logging
• Configure SentinelOne Deep Visibility to track module loads associated with Dante Application Library components
• Monitor file system activity in directories containing mDNSResponder.exe for suspicious DLL creation
• Implement integrity monitoring for application directories to detect unauthorized file modifications

How to Mitigate CVE-2022-23748

Immediate Actions Required

• Update Audinate Dante Application Library to the latest patched version as specified in the Audinate Security Advisory
• Review systems for indicators of compromise before and after patching
• Implement application control policies to restrict DLL loading to trusted paths
• Audit all systems running Dante Discovery or related Audinate software for vulnerable versions

Patch Information

Audinate has released guidance and updates to address this vulnerability. Organizations should consult the official Audinate Response to CVE-2022-23748 for specific patch information and updated software versions. Given the active exploitation status documented in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and critical infrastructure organizations should prioritize remediation according to CISA binding operational directive timelines.

Workarounds

• Restrict write permissions on directories containing mDNSResponder.exe to prevent unauthorized DLL placement
• Implement Windows Defender Application Control (WDAC) or AppLocker policies to control DLL loading
• Enable SafeDLL search mode by setting the CWDIllegalInDllSearch registry value
• Consider network segmentation to limit the impact of compromised audio networking systems
• Monitor and alert on any execution of mDNSResponder.exe from non-standard locations

# Enable SafeDLL search mode to mitigate DLL sideloading risks
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f

# Verify the setting was applied
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch