# Privileged process loads from user-writable path

Does an elevated process resolve a DLL, config or handler from a location a low-privileged user can write?

_Area: Memory corruption and native code. Seen in 4 disclosed reports; 2 confirmed bounties: $1,250 and $13,337; latest 2026-08-28. Updated 2026-11-02._

## How it works
A process running at higher privilege than the attacker (SYSTEM, admin, elevated user) resolves a resource — a DLL, a config file, a URL handler — by name or by a path it builds itself, and the resolution lands somewhere the low-privileged user controls. The broken assumption is that "the path I compute" or "the name I import" points at trusted content. Windows resolves DLL imports by search order with the application directory ahead of System32, so a planted `mscoree.dll` beside a signed utility wins [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md); `Path.Combine` lets a later segment containing a drive letter or backslashes discard the trusted parent [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md); `ShellExecute` on a URL resolves the protocol handler from HKCU, which the current user can write [E2](https://bugbountylibrary.com/r/h1%3A530292.md); a loaded `libssl10.dll` probes a hardcoded build-time config path that happens to sit under a user-writable root [E3](https://bugbountylibrary.com/r/h1%3A944735.md). In every case the privileged process trusts a name or path an unprivileged party can satisfy first.

## Where it shows up
- Privileged updaters or services that build file paths from remote metadata (URLs, JSON fields) [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)
- Hardcoded absolute paths left from build machines (`C:\bs_hudson\workspace\...`) probed by a loaded library [E3](https://bugbountylibrary.com/r/h1%3A944735.md)
- Elevated processes calling `ShellExecute`/`CreateProcess` on URLs or file associations [E2](https://bugbountylibrary.com/r/h1%3A530292.md)
- Signed binaries that import a DLL by bare name and sit in a writable directory [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md)
- Services probing non-existent files under user-writable roots (visible in Procmon) [E3](https://bugbountylibrary.com/r/h1%3A944735.md)
- Registry handler keys under `HKCU\Software\Classes` consulted by an elevated process [E2](https://bugbountylibrary.com/r/h1%3A530292.md)

## How to review
Identify every resource a privileged process resolves and ask: can a non-admin write to the location it will be read from? The invariant: for any file, DLL or handler a higher-integrity process loads, the resolved path must be in a directory writable only by that higher privilege, or the content must be integrity-checked before use. Check path construction for segments that can override the parent (drive letters, leading backslashes, `..`) [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md); check DLL imports against the search order and the binary's own directory permissions [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md); check whether config or handler lookups fall back to HKCU or a user-writable root [E2](https://bugbountylibrary.com/r/h1%3A530292.md)[E3](https://bugbountylibrary.com/r/h1%3A944735.md).

## How finders spotted it
- Enumerated local services with Procmon, spotted a SYSTEM service, guessed .NET from its `.config`, decompiled, and traced JSON handling into `Path.Combine` with a user-controlled URL filename [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)
- Noticed an elevated process opening a web page via `ShellExecute` and reasoned that URL handler resolution trusts HKCU keys the user can write [E2](https://bugbountylibrary.com/r/h1%3A530292.md)
- Used Procmon to see a service load `libssl10.dll`, which then probed a non-existent hardcoded build path; recognized the path was user-creatable and that OpenSSL config allows dynamic engine loading [E3](https://bugbountylibrary.com/r/h1%3A944735.md)
- Reverse-engineered the sideloaded `mscoree.dll` payload: spotted a `CreateProcessW` call site lacking `CREATE_SUSPENDED`, then an indirect call via a resolved function pointer with magic-byte checks; static cross-refs dead-ended in `.data`/`.rdata` until `.NET 7.0` strings and the `.managed` section revealed NativeAOT [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md)

## Variants seen
- Path injection via `Path.Combine` in an updater writing as SYSTEM [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)
- URL protocol handler hijack through HKCU for UAC bypass [E2](https://bugbountylibrary.com/r/h1%3A530292.md)
- Hardcoded config path under a user-writable root enabling OpenSSL engine DLL load [E3](https://bugbountylibrary.com/r/h1%3A944735.md)
- Classic DLL search-order hijack beside a signed binary [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md)

## Impact and severity
Reached SYSTEM or admin code execution from a low-privileged starting point [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)[E2](https://bugbountylibrary.com/r/h1%3A530292.md)[E3](https://bugbountylibrary.com/r/h1%3A944735.md); in the Okta case chained from arbitrary file write to DLL hijack for SYSTEM RCE [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md). Sideloading gave code execution and defense evasion on endpoints [E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md). Severity is high because the primitive crosses a privilege boundary; impact rises with what the hijacked context can reach (persistence, binary replacement, defense evasion) [E1](https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md)[E2](https://bugbountylibrary.com/r/h1%3A530292.md)[E4](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Microsoft Windows** (DLL search-order loader) (version not stated): From 88 lines to 1: Detecting DLL hijacking with Elastic Defend. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md
- **Okta Verify for Windows** (Okta.AutoUpdate.Executor) (version not stated): Okta Verify for Windows Remote Code Execution – CVE-2024-0980 (CVE-2024-0980). Report: https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md
- **VeraCrypt**: Local Privilege Escalation during execution of VeraCryptExpander.exe (UAC bypass) (CVE-2019-19501). Report: https://bugbountylibrary.com/r/h1%3A530292.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Asecurifera-com-blog-2024-05-02-okta-verify-for-windows-remote-code-execution-cve-2024-0980.md
- E2: https://bugbountylibrary.com/r/h1%3A530292.md
- E3: https://bugbountylibrary.com/r/h1%3A944735.md
- E4: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md