A DLL search order hijacking vulnerability in Hubstaff allows local attackers to achieve remote code execution by placing a malicious library in the system directory.

The application is susceptible to a DLL hijacking attack due to an uncontrolled search path element (CWE-427). An attacker with local access can place a malicious "wow64log.dll" file into the system32 directory, which the application will execute upon startup.

Successful exploitation allows an attacker to gain full control over the local system, potentially leading to the compromise of sensitive employee data, timesheets, and billing information stored or processed by the application. Given the CVSS score of 7.8, this vulnerability represents a high risk for organizations using Hubstaff, as it facilitates unauthorized access and potential lateral movement within the corporate network.

Immediate Action: Update the Hubstaff application to the latest available version provided by the vendor, which addresses the insecure DLL loading path.

Proactive Monitoring: Monitor endpoint logs for the creation of unexpected DLL files in system directories and review process execution logs for anomalous activity originating from the Hubstaff application startup sequence.

Compensating Controls: Implement strict file system permissions on the system32 directory to prevent unauthorized users from creating or modifying files, and utilize Endpoint Detection and Response (EDR) solutions to flag suspicious file creation events.

Public Exploit Available: Yes — a public exploit and technical write-up are available on ExploitDB (EDB-ID: 51461).

Organizations should treat this vulnerability with high priority due to the availability of public exploit code and the significant impact of local code execution. System administrators must ensure that all instances of the affected Hubstaff software are updated immediately to prevent potential system compromise by local attackers.