Attack Chain

1. The attacker gains local access to a system with Alloksoft Video Joiner 4.6.1217 installed.
2. The attacker identifies the “License Name” field within the application’s registration process as a potential vulnerability point.
3. The attacker crafts a malicious string that exceeds the expected buffer size for the “License Name” field.
4. The malicious string includes an SEH overwrite payload, redirecting execution flow to the attacker’s controlled memory.
5. The crafted string also contains shellcode designed to perform arbitrary code execution.
6. The attacker inputs the malicious string into the “License Name” field and submits the registration form.
7. The application attempts to process the oversized string, triggering a buffer overflow.
8. The SEH overwrite redirects execution to the injected shellcode, granting the attacker arbitrary code execution within the context of the Alloksoft Video Joiner process.

Impact

Successful exploitation of this buffer overflow vulnerability allows a local attacker to execute arbitrary code with the privileges of the Alloksoft Video Joiner application. This could lead to complete system compromise, data theft, or installation of malware. While the specific number of affected users is unknown, any system running the vulnerable version of the software is at risk.

Recommendation

• Monitor process creations for VideoJoiner.exe spawning unusual child processes, indicative of code execution stemming from the overflow.
• Consider deploying network egress rules to block connections originating from VideoJoiner.exe to external IPs to prevent command and control.
• Implement application control policies to prevent the execution of unsigned or untrusted code within the context of VideoJoiner.exe.