Qt5-Based GUI Apps Susceptible to Remote Code Execution

Through a little known command line argument, applications that configure custom protocol handlers and are are developed using the Qt5 graphical user interface framework can be exposed to a remote code execution vulnerability. What many developers don't know is that when you use the Qt5 framework, it also adds command line arguments that can be used to modify how the framework works, such as what window title to show, the size of the window, or even its icon. These command line arguments are passed to the function that initializes the Qt framework, where they are then parsed as shown below. One command line argument that is not well known is the platformpluginpath command, which specifies what folder Qt5 plugins are loaded from. This location can be a local folder or a remote UNC url. When this argument is provided, the program will use the inputted path to load the program's Qt plugins, which are specially crafted DLL programs that get loaded by the framework to extend its functionality. This means that if an attacker hosts a malicious DLL on a remote UNC share and can start the program using the platformpluginpath argument, they can remote load the DLL and execute it. In a report by Zero Day Initiative, security researcher Ziad Badawi explains how Qt5 based applications that create a custom URI handler and do not properly sanitize their command line arguments are vulnerable to remote code execution simply by clicking on a link on a web site. To illustrate how this command ...