A DLL hijacking vulnerability in Quark Cloud Drive v3.23.2 enables unauthenticated attackers to achieve arbitrary code execution on the host system.

The application insecurely loads system libraries without validating the path or signature of the targeted executable, specifically regsvr32.exe. An unauthenticated attacker can place a crafted malicious DLL in the startup directory to facilitate arbitrary code execution when the application launches.

The ability for an attacker to execute arbitrary code locally poses a severe threat to data integrity and system confidentiality. Given the CVSS score of 7.5, this high-severity flaw could lead to complete system compromise, unauthorized access to sensitive cloud-stored documents, and potential lateral movement within the corporate network.

Immediate Action: Restrict write access to the application installation and startup directories to prevent the placement of malicious files. Contact the vendor to confirm the availability of a security patch that enforces signature validation during library loading.

Proactive Monitoring: Audit file system integrity within the application directory for the presence of unauthorized or suspicious DLL files. Monitor process execution logs for unexpected child processes spawned by the Quark Cloud Drive executable.

Compensating Controls: Deploy Endpoint Detection and Response (EDR) solutions to flag or block the execution of untrusted DLLs loaded by authorized software.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub repository.

Organizations utilizing Quark Cloud Drive v3.23.2 must treat this vulnerability with high urgency due to the ease of local exploitation. While awaiting a vendor-supplied patch, administrators should prioritize hardening the directory permissions of the application to prevent unauthorized modification. Continuous monitoring for anomalous file creation in the application folder is essential to mitigate the risk of compromise.