Yandex Browser for Desktop vulnerable to DLL Hijacking
CVE-2024-6473

7.8HIGH

Key Information:

Vendor

Yandex

Status
Browser
Vendor
CVE Published:
3 September 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-6473?

The Yandex Browser for Desktop versions prior to 24.7.1.380 is susceptible to a DLL Hijacking vulnerability. This arises from the usage of an untrusted search path, potentially allowing malicious actors to execute harmful code by placing malicious DLL files in a location that the browser may inadvertently access. Addressing this vulnerability is vital to protect users from potential exploitation and ensure the integrity of system operations. Users are recommended to upgrade to the latest version to mitigate associated risks.

Affected Version(s)

Browser Windows 0 < 24.7.1.380

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6473-PoC
Created by 12345qwert123456

References

https://yandex.com/bugbounty/i/hall-of-fame-browser/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Doctor Web, Ltd.
JSON
.