CVE-2020-24158 in 360 Speed Browser
Summary
by MITRE
360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned by Beijing Qihoo Technology.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2020
The CVE-2020-24158 vulnerability represents a critical DLL hijacking flaw in 360 Speed Browser version 12.0.1247.0, a dual-core browser developed by Beijing Qihoo Technology. This vulnerability stems from improper dynamic link library loading mechanisms within the browser's execution environment, creating a pathway for malicious code execution. The flaw specifically manifests when the browser attempts to load required system libraries without properly validating the library paths, allowing attackers to place malicious DLL files in strategic locations where the browser will load them automatically.
This vulnerability operates under the broader category of DLL hijacking as classified by CWE-778, which falls within the software security domain of improper library loading practices. The technical implementation involves the browser's failure to enforce secure library loading protocols, particularly in how it resolves library dependencies during runtime execution. Attackers can exploit this by placing malicious DLL files in directories that the browser searches before system directories, leveraging the principle that Windows resolves library paths sequentially from the current directory upward through the system path. The vulnerability is particularly concerning because it requires minimal user interaction for exploitation, making it suitable for automated attacks and social engineering campaigns.
The operational impact of this vulnerability extends beyond simple code execution, creating potential for privilege escalation and system compromise within the context of the browser's operational environment. When successfully exploited, attackers can execute arbitrary code with the privileges of the browser process, potentially leading to full system compromise if the browser runs with elevated privileges. The dual-core nature of 360 Speed Browser, which operates with both Chromium and Internet Explorer engines, increases the attack surface by providing multiple potential entry points for exploitation. This vulnerability aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage, and T1068 for exploit for privilege escalation, making it a significant concern for enterprise security environments where such browsers may be widely deployed.
Mitigation strategies for this vulnerability require immediate remediation through software updates from the vendor, as the flaw exists within the browser's core library loading mechanisms. System administrators should implement additional protective measures including directory permissions hardening, monitoring for unauthorized DLL placement, and employing application whitelisting policies to prevent execution of untrusted libraries. The vulnerability also necessitates endpoint detection and response solutions that can identify suspicious library loading patterns and anomalous behavior in browser processes. Security professionals should consider implementing process monitoring to detect when browsers attempt to load libraries from non-standard locations, as this behavior is indicative of potential DLL hijacking attempts. Additionally, users should be educated about the risks of downloading content from untrusted sources and the importance of maintaining updated software versions to prevent exploitation of known vulnerabilities.