# Signed binary loads library from writable path

Trusted process resolving a DLL, dylib or COM class from a user-writable directory

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2024-08-28. Updated 2026-11-08._

## How it works
A trusted process resolves a library or COM class by name and lets the loader search directories an unprivileged user can write to. The signature on the host binary proves nothing about what it loads: the loader trusts a path, not the code. The same break appears when one operation has two code paths and only one runs the safety check.

## Where it shows up
- `InProcServer32` / `DllSurrogate` COM registrations under `HKU\Software\Classes\CLSID` pointing at signed DLLs in user AppData [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md)
- A signed DLL that imports a patched dependency from a user-writable directory (sideloading) [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md)
- A download path that writes a library into a mod or app folder which the client loads on next start [E1](https://bugbountylibrary.com/r/h1%3A508894.md)
- Two paths for one operation (UDP netchan vs HTTP fast-download) where validation runs on only one [E1](https://bugbountylibrary.com/r/h1%3A508894.md)
- Weak validation: a check that only blocks `..` and `server.cfg` substrings instead of an allowlist [E1](https://bugbountylibrary.com/r/h1%3A508894.md)
- Unsigned dylibs loaded by an app bundle, or hidden dot-prefixed Mach-O files [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sinking-macos-pirate-ships.md)

## How to review
Identify every library/class the trusted process resolves and the exact directory it comes from. The invariant: a signed or privileged process must load only from a directory an unprivileged user cannot write, or must verify the loaded module's signature/allowlist before use. For COM, confirm the CLSID resolves to a system path, not user-writable storage. For dual-path code, confirm the same validation function runs on every path, not just the default one, and that the check is an allowlist rather than a substring denylist [E1](https://bugbountylibrary.com/r/h1%3A508894.md).

## How finders spotted it
- Reverse-engineered engine binaries (IDA pseudocode of build 7960), diffed the netchan and HTTP download paths, and saw `IsSafeFileToDownload` called in `Netchan_CopyFileFragments` but not on the HTTP path, and only for generic resources [E1](https://bugbountylibrary.com/r/h1%3A508894.md)
- Hunting rules flagged a system infrequently running a few admin commands from an odd parent; pivoting on footholds surfaced masqueraded tasks and COM handlers [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md)
- Noticed the unsigned dylib was the only non-system library loaded, then traced child processes and persistence [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sinking-macos-pirate-ships.md)

## Variants seen
- Server-pushed DLL into a client mod folder via an unchecked download path [E1](https://bugbountylibrary.com/r/h1%3A508894.md)
- COM handler hijack pointing at a signed DLL that imports a patched dependency [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md)
- Pirated app bundle loading an unsigned dylib dropper [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sinking-macos-pirate-ships.md)

## Impact and severity
Code execution in the context of a trusted process, often SYSTEM or the user. Scale raised impact: one malicious server infected all connecting clients [E1](https://bugbountylibrary.com/r/h1%3A508894.md); a beachhead reached SYSTEM and persisted through redundant backdoors over years [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md). Severity is high when the loaded code runs privileged or spreads to other hosts.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **IIS Express** (iisutil2.dll) (version not stated): APT Targeting Vietnamese Human Rights Defenders. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A508894.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sinking-macos-pirate-ships.md