Worst-case scenario for ShellExecute(0,“open”,arbitrary_string)

Question

I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute.

Aside from opening arbitrary URLs (incl. custom registered application protocols, which can be used to exploit vulnerabilities in them), this allows opening any file on the filesystem given its absolute path. I don't think it's possible to launch programs with custom parameters directly.

Aside from relying on vulnerabilties in other apps' custom protocol handling, what's the worst-case scenario of such a vulnerability?

Answer 1

There are a variety of things you could do with this issue:

• Set up a shared directory on the network, put an executable on it, then send the path to that share.
• Open the user's browser to a page containing browser exploits, by passing the URL.
• Launch a game in order to generate a temporary DoS whilst it loads.
• Launch a maintenance script for a known-installed application in order to damage or destroy data.
• Launch a network service that's available on the system, then use that to gain further access.