Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found an application that uses ShellExecute to open hyperlinks. However, it doesn't check if the string is actually a hyperlink - it is passed directly to ShellExecute.

Aside from opening arbitrary URLs (incl. custom registered application protocols, which can be used to exploit vulnerabilities in them), this allows opening any file on the filesystem given its absolute path. I don't think it's possible to launch programs with custom parameters directly.

Aside from relying on vulnerabilties in other apps' custom protocol handling, what's the worst-case scenario of such a vulnerability?

share|improve this question
add comment

1 Answer

There are a variety of things you could do with this issue:

  • Set up a shared directory on the network, put an executable on it, then send the path to that share.
  • Open the user's browser to a page containing browser exploits, by passing the URL.
  • Launch a game in order to generate a temporary DoS whilst it loads.
  • Launch a maintenance script for a known-installed application in order to damage or destroy data.
  • Launch a network service that's available on the system, then use that to gain further access.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.