# Node.js - DLL Hijacking on Windows

Node.js on Windows loads providers.dll via untrusted search path when OpenSSL config exists, letting local attackers hijack the DLL for privilege escalation and persistence.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: yakirka
- Disclosed: 2022-07-25
- CVE: CVE-2022-32223
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1636566
- Library page: https://bugbountylibrary.com/r/h1%3A1636566
- Tags: area:os domain:desktop impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:nodejs tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** node.exe DLL loading on Windows
**Root cause:** When OpenSSL is installed and C:\Program Files\Common Files\SSL\openssl.cnf exists, node.exe loads providers.dll using the Windows DLL search order, which includes the current user directory, allowing a malicious DLL to be loaded.
**Steps:**
1. Ensure victim Windows machine has OpenSSL installed or `C:\Program Files\Common Files\SSL\openssl.cnf` exists
2. Place malicious `providers.dll` in a directory earlier in the DLL search order (e.g. current working directory)
3. Run `node.exe`; it loads the attacker's `providers.dll`
4. Alternatively rename provider via `Providers=provider_sect` in openssl.cnf to load a custom-named DLL
5. Ship malicious DLL inside an npm package so it executes on install/run without visible code interaction
**How found:** Researcher observed node.exe resolving providers.dll through the Windows DLL search order when OpenSSL config was present, hypothesizing the current user directory could be abused.
**Exploitation:** Attacker places a malicious providers.dll in a path resolved by the Windows DLL search order (or bundles it in an npm package); when node.exe starts on a machine with OpenSSL config present, the DLL is loaded and attacker code executes, yielding local privilege escalation or persistence.
**Escalation:** Bundling the malicious DLL in npm packages extends the attack to supply-chain style distribution to victims who install packages.
**Insight:** On Windows, check whether binaries load DLLs by bare name when an optional config file (like openssl.cnf) exists; the presence of that config can flip on a code path that uses the insecure default DLL search order including CWD.