EmoCheck Insecure DLL Loading Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in EmoCheck, a tool for detecting Emotet malware infections, due to insecure loading of Dynamic Link Libraries (DLLs). This flaw allows arbitrary code to be executed with the privileges of the user running EmoCheck. The vulnerability arises from an uncontrolled search path element, enabling the execution of crafted DLL files placed in the same directory as the application.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution with the privileges of the user invoking EmoCheck.

Reproduction

To reproduce this vulnerability, place a crafted DLL file in the same directory as the EmoCheck application. Then, execute EmoCheck. The application will load the DLL file, allowing the embedded code to run with the user's privileges.

Remediation

Users are advised to stop using EmoCheck, as the tool is no longer available. For those who have been using it, immediate cessation of use is recommended.