Mitigate .local DLL redirection Windows bug.
Bob Arnson committed
Jan 24, 2024 at 17:38 UTC
ce9ef4702cddf9a2398f6fbb7702988b662b5565
2 files changed
+27
src/burn/stub/precomp.h
+1
@@ -9,6 +9,7 @@
9
10
#include <dutil.h>
11
#include <apputil.h>
12
+#include <dirutil.h>
13
#include <strutil.h>
14
#include <fileutil.h>
15
#include <pathutil.h>
src/burn/stub/stub.cpp
+26
@@ -2,6 +2,10 @@
2
3
#include "precomp.h"
4
5
+static const HRESULT E_SUSPECTED_TAMPERING = MAKE_HRESULT(SEVERITY_ERROR, 500/*FACILITY_WIX*/, 2001);
6
+
7
+static void AvoidLocalDllRedirection(LPCWSTR wzPath);
8
+
9
10
int WINAPI wWinMain(
11
__in HINSTANCE hInstance,
@@ -52,6 +56,8 @@ int WINAPI wWinMain(
56
AppInitialize(rgsczSafelyLoadSystemDlls, countof(rgsczSafelyLoadSystemDlls));
57
}
58
59
+ AvoidLocalDllRedirection(sczPath);
60
+
61
// call run
62
hr = EngineRun(hInstance, hEngineFile, lpCmdLine, nCmdShow, &dwExitCode);
63
ExitOnFailure(hr, "Failed to run application.");
@@ -63,3 +69,23 @@ LExit:
69
70
return FAILED(hr) ? (int)hr : (int)dwExitCode;
71
}
72
+
73
+static void AvoidLocalDllRedirection(LPCWSTR wzPath)
74
+{
75
+ LPWSTR sczLocalPath = NULL;
76
+ HMODULE hmodComCtl = NULL;
77
+
78
+ // Bail if there's a <bundle>.exe.local directory, as it's a feature of
79
+ // DLL redirection that has no real use for a bundle and is a hole for
80
+ // DLL hijacking attacks.
81
+
82
+ if (FAILED(StrAllocFormatted(&sczLocalPath, L"%ls.local", wzPath))
83
+ || DirExists(sczLocalPath, NULL)
84
+ || FileExistsEx(sczLocalPath, NULL)
85
+ || FAILED(LoadSystemLibrary(L"Comctl32.dll", &hmodComCtl)))
86
+ {
87
+ ::ExitProcess((UINT)E_SUSPECTED_TAMPERING);
88
+ }
89
+
90
+ ReleaseStr(sczLocalPath);
91
+}