JetBrains PyCharm Professional 2016.1.4 DLL Hijacking

Risk: Medium
Local: Yes
Remote: No

Aloha, *pycharm-professional-2016.1.4.exe* loads and executes dwmapi.dll from its "application directory". For software downloaded with a web browser the applicationdirectory is typically the user's "Downloads" directory: see < >, < > and <> for "prior art" about this well-known and well-documented vulnerability. If an attacker places one of the above named DLL in the user's "Downloads" directory (for example per "drive-by download" or "social engineering") this vulnerability becomes a remote code execution. Proof of concept/demonstration: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1. Create malicious dll file and save it as dwmapi.dll in your "Downloads" directory. 2. Download pycharm-professional-2016.1.4.exe from and save it in your "Downloads" directory. 3. Execute pycharm-professional-2016.1.4.exe from your "Downloads" directory. 4. Malicious dll file gets executed. Chao!! Himanshu Mehta

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019,


Back to Top