OpenOrange Business Framework DLL Hijacking Vulnerability Allowing Arbitrary Code Execution and Privilege Escalation

A DLL hijacking vulnerability exists in OpenOrange Business Framework version 1.15.5. The issue arises from improper permissions in the installation directory, which allow unprivileged users to write malicious DLLs. These DLLs are automatically loaded by the application, potentially leading to arbitrary code execution and privilege escalation, especially if executed by a user with administrative rights.

Impact

Exploitation allows for arbitrary code execution. If the code is executed with elevated privileges, it could lead to a full system compromise.

Reproduction

The vulnerability can be reproduced by placing a malicious DLL in the OpenOrange installation directory, which is accessible to all authenticated users. Once the DLL is placed, it will be loaded the next time the OpenOrange application is run, including when it is executed by an administrator.

Remediation

Users are advised to restrict write access to the OpenOrange installation directory and to avoid loading DLLs from user-writable paths.