CVE-2012-1854: Microsoft VBA Insecure Library Loading

Technical Analysis

The vulnerability stems from the way VBE6.dll handles dynamic library loading. When an Office application initiates a request, it searches for necessary libraries in paths defined by the process’s current working directory. If an attacker places a Trojan horse DLL alongside a document file (e.g., a .docx file), the application inadvertently prioritizes the malicious DLL in the local directory over the legitimate system DLL.

Exploitation Flow

Preparation: The attacker crafts a malicious DLL and gives it a name matching a legitimate DLL expected by the VBA component.
Delivery: The attacker lures a victim into opening a folder containing both the malicious DLL and a seemingly harmless Office document (e.g., .docx).
Execution: Upon opening the document, the application initializes the VBA environment, attempts to load the legitimate DLL, and executes the code within the malicious library present in the local directory.

Forensic Investigation

Log Review: Inspect Windows Event Logs for Event ID 7 (Image Loaded) where ImageLoaded path is unusual (not in System32).
Artifact Analysis: Identify any DLL files created in user directories (e.g., Downloads, Documents) that coincide with Office document access timestamps.
Process Monitoring: Analyze parent/child process relationships where WINWORD.EXE or EXCEL.EXE loads external, non-signed libraries.

Detection

Sigma Detection (Rule): Focus on ImageLoad events with non-standard paths.
Threat Hunting (KQL): DeviceImageLoadEvents | where FileName endswith "VBE6.dll" | where FolderPath !startswith "C:\\Windows\\System32"

Mitigation

Apply vendor-supplied security patches (MS12-046).
Implement strict application control policies.
Disable VBA macros via Group Policy if not required for business processes.