Hey Cygwin Team, I hope this email finds you well. As an independent security researcher, I often explore open-source projects to identify and report potential security vulnerabilities. During my recent exploration of Cygwin, I came across a critical vulnerability in setup-x86_64.exe <https://cygwin.com/setup-x86_64.exe> that I believe warrants your immediate attention.
1. Executive Summary: The vulnerability pertains to not finding the profapi.dll, CFGMGR32.dll, edputil.dll, urlmon.dll, SspiCli.dll, Wldp.dll, MPR.dll, ServicingCommon.dll, TextShaping.dll, CRYPTBASE.DLL, PROPSYS.dll and insecure loading of dynamic link libraries (DLLs), specifically profapi.dll. If exploited, this vulnerability could allow an attacker to execute arbitrary code on a victim's machine, potentially leading to data breaches, system compromise, and other malicious activities. 2. Details of the Vulnerability: Type: DLL Hijacking Affected Component: profapi.dll, CFGMGR32.dll, edputil.dll, urlmon.dll, SspiCli.dll, Wldp.dll, MPR.dll, ServicingCommon.dll, TextShaping.dll, CRYPTBASE.DLL, PROPSYS.dll Impact: Remote Code Execution, Data Theft or Manipulation, Persistence, Bypassing Security Mechanisms, Spreading Malware. Description: The application attempts to load profapi.dll from its current working directory (CWD). If a malicious version of test.dll is present in the CWD, the application will inadvertently load and execute the malicious DLL. 3. Proof of Concept: I've attached a proof of concept to this email, demonstrating the vulnerability in action. Please review it to understand the potential impact and exploitability. The link is given below: POC Video: https://drive.google.com/file/d/11rBPnImiZS-CEwPM9eBlU6GSHjHYD2ns/view?usp=sharing This is a POC video for profapi.dll. All other DLLs are hijacked in similar method 4. Conclusion: The identified DLL Hijacking vulnerability poses a significant risk to users of Cygwin during the installation and executing the setup-x86_64.exe <https://cygwin.com/setup-x86_64.exe>. I urge you to address this issue promptly. I'm available for any further clarification or assistance in addressing the vulnerability Thank you for your attention to this matter, and I appreciate the hard work you put into maintaining and improving open-source projects for the community.Best regards, Submitted by: Suman Kumar Chakraborty LinkedIn:https://www.linkedin.com/in/suman-chakraborty-b857901b1/ -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
