CVE-2010-3155

Vulnerability

Adobe ExtendScript Toolkit (ESTK) CS5 version 3.5.0.52 contains an untrusted search path vulnerability. When opening a .jsx script file, the application searches for and loads the dwmapi.dll library from the current working directory before checking system paths. This allows an attacker to place a malicious dwmapi.dll in the same folder as a .jsx file, leading to DLL hijacking [1].

Exploitation

An attacker must craft a malicious dwmapi.dll (e.g., compiled with gcc -shared -o dwmapi.dll as shown in the exploit code) and place it in a folder containing a .jsx file. When a user opens the .jsx file from that folder, the ESTK loads the attacker's DLL, executing arbitrary code with the user's privileges [1]. The attack can be performed locally or remotely (e.g., via a downloaded archive).

Impact

Successful exploitation results in arbitrary code execution at the privilege level of the current user. The attacker gains full control over the affected system, enabling further compromise.

Mitigation

No official patch was released by Adobe for this vulnerability. Users should avoid opening .jsx files from untrusted sources and ensure that system DLL search paths are secure. Upgrading to a newer version of ESTK or Adobe Creative Suite may mitigate the issue [1].