CVE-2023-28260: Microsoft .NET DLL Hijacking RCE Flaw

CVE-2023-28260 Overview

CVE-2023-28260 is a DLL Hijacking vulnerability affecting Microsoft .NET and Visual Studio 2022. This vulnerability allows an attacker with local access to execute arbitrary code by exploiting improper DLL loading mechanisms in the .NET runtime. When a .NET application loads DLLs without proper path validation, an attacker can place a malicious DLL in a location where it will be loaded instead of the legitimate library, resulting in code execution with the privileges of the running application.

Critical Impact

Successful exploitation of this DLL Hijacking vulnerability allows attackers to achieve arbitrary code execution, potentially leading to complete system compromise, data theft, or lateral movement within an organization's network.

Affected Products

• Microsoft .NET
• Microsoft Visual Studio 2022

Discovery Timeline

• April 11, 2023 - CVE-2023-28260 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-28260

Vulnerability Analysis

This vulnerability stems from insecure DLL loading practices within the .NET framework and Visual Studio 2022. When applications built on or running within these environments attempt to load dynamic link libraries, they may search for DLLs in directories that could be writable by lower-privileged users. An attacker can exploit this by placing a crafted malicious DLL with the same name as an expected legitimate DLL in a location that is searched before the legitimate DLL's location.

The attack requires local access to the system, meaning the attacker must already have some level of access to the target machine. Once the malicious DLL is placed, the next time a vulnerable .NET application or Visual Studio process loads the expected DLL, the attacker's code will execute instead. This can result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2023-28260 lies in the DLL search order behavior within Windows combined with insufficient validation of DLL paths in the .NET runtime and Visual Studio. When applications do not explicitly specify the full path to required DLLs, Windows follows a predefined search order that may include user-writable directories. The .NET framework components affected by this vulnerability fail to properly restrict or validate the directories from which DLLs are loaded, creating an opportunity for DLL hijacking attacks.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have access to the target system. The exploitation process typically follows these steps:

1. The attacker identifies a .NET application or Visual Studio component that loads DLLs without proper path specification
2. The attacker determines which DLLs are loaded and identifies writable directories in the search path
3. A malicious DLL is crafted with the same name as the expected legitimate DLL, containing the attacker's payload
4. The malicious DLL is placed in a directory that appears earlier in the search order than the legitimate DLL location
5. When the target application runs and attempts to load the DLL, the malicious version is loaded instead, executing the attacker's code

No user interaction is required once the malicious DLL is in place—the code executes automatically when the vulnerable application loads the compromised library.

Detection Methods for CVE-2023-28260

Indicators of Compromise

• Unexpected DLL files appearing in application directories, user profile folders, or current working directories of .NET applications
• DLL files with names matching common .NET framework libraries located outside of standard installation paths (%ProgramFiles%\dotnet, %ProgramFiles%\Microsoft Visual Studio)
• Process creation events showing .NET applications loading DLLs from non-standard locations
• File system audit logs showing DLL writes to directories commonly targeted for DLL hijacking attacks

Detection Strategies

• Enable DLL load auditing through Windows Security Event logs (Event ID 7045) to monitor for suspicious library loading patterns
• Deploy application whitelisting solutions to detect unauthorized DLL loading by Visual Studio and .NET runtime processes
• Implement file integrity monitoring on critical application directories to detect unauthorized DLL placement
• Use SentinelOne's behavioral AI to detect anomalous DLL loading patterns and process hollowing attempts

Monitoring Recommendations

• Monitor process creation events for .NET applications with unusual parent-child relationships or spawning unexpected subprocesses
• Track file creation events in directories commonly exploited for DLL hijacking, including current working directories and user-writable paths in the system PATH
• Implement network monitoring to detect data exfiltration or command-and-control communications following potential exploitation
• Review application logs and Windows Event Viewer for .NET runtime errors that may indicate failed hijacking attempts

How to Mitigate CVE-2023-28260

Immediate Actions Required

• Apply the latest security updates from Microsoft for both .NET and Visual Studio 2022 immediately
• Review all .NET applications for proper DLL loading practices and ensure full paths are specified where possible
• Audit and restrict write permissions on directories in the system PATH environment variable
• Enable Windows Defender Attack Surface Reduction (ASR) rules related to DLL side-loading

Patch Information

Microsoft has released security patches addressing this vulnerability. Administrators should apply updates from the Microsoft Security Update Guide. Ensure that Windows Update is configured to receive and install security updates automatically, or manually download and apply patches for environments with restricted update policies.

For .NET applications, update to the latest patched versions of the .NET runtime. For Visual Studio 2022, apply the latest security update through the Visual Studio Installer or Windows Update.

Workarounds

• Configure application manifests to use side-by-side assemblies, which specify exact DLL versions and locations
• Implement strict file system permissions to prevent non-administrative users from writing to directories in the DLL search path
• Use Windows Defender Application Control (WDAC) or AppLocker policies to restrict DLL loading to trusted locations only
• Consider enabling SafeDllSearchMode in the Windows registry if not already enabled (enabled by default on modern Windows versions)

# Enable SafeDllSearchMode via registry (if disabled)
reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f

# Verify .NET and Visual Studio update status using PowerShell
dotnet --list-sdks
dotnet --list-runtimes