dorkerdevil/cve-2026-89282Proof-of-concept for CVE-2026-89282: proxy DLL search-order hijack in Apache Lounge Windows installs that yields SYSTEM privilege escalation on service restart.
Author: Ashish Kunwar (@D0rkerDevil)
Date: 2026-10-17
CVE: CVE-2026-89282
CWE: CWE-427 (Uncontrolled Search Path Element) / CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS 3.1: 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Fixed in: Apache Lounge 2.4.68-260920 Win64 (September 20, 2026)
The Apache Lounge Windows distribution of Apache HTTP Server (prior to build 2.4.68-260920) installs with insecure default ACLs that grant BUILTIN\Users write access (WD + AD) to the installation directory tree, including C:\Apache24\bin\. Combined with standard Windows DLL search order — which loads from the application directory before System32 for DLLs not in the KnownDLLs registry key — any local standard user can plant a proxy DLL that executes arbitrary code as NT AUTHORITY\SYSTEM when the Apache service restarts.
This PoC demonstrates full exploitation: a low-privilege user plants a proxy VCRUNTIME140.dll with 71 PE export forwarders in C:\Apache24\bin\. On Apache restart, httpd.exe (running as LocalSystem) loads the proxy, which forwards all legitimate calls to the real DLL while executing a SYSTEM-privileged payload in DllMain. Apache continues serving normally — non-crashing, non-disruptive.
Apache Lounge's Windows installer creates C:\Apache24\ under C:\, which on Windows inherits Authenticated Users: Modify permissions by default. The installer does not harden these ACLs. This grants any local user the ability to write new files into:
| Directory | Impact |
|---|---|
C:\Apache24\bin\ | DLL hijack — 21 hijackable system DLLs |
C:\Apache24\modules\ | Direct module injection |
C:\Apache24\conf\ | Configuration tampering |
C:\Apache24\htdocs\ | Web content modification |
The Apache24 service runs as LocalSystem (SYSTEM) with AUTO_START, making any DLL loaded from the application directory execute at the highest Windows privilege level.
# Cross-compile from Linux/macOS (mingw-w64)
x86_64-w64-mingw32-gcc -shared -o VCRUNTIME140.dll vcruntime140_hijack.c vcruntime140.def \
-Wl,--enable-stdcall-fixup -s
# Or compile on Windows (MSVC)
cl /LD vcruntime140_hijack.c /link /DEF:vcruntime140.def /OUT:VCRUNTIME140.dll
REM Create hard link to the real DLL for export forwarding
mklink /H "C:\Apache24\bin\vcruntime140_orig.dll" "C:\Windows\System32\VCRUNTIME140.dll"
REM Plant the proxy DLL
copy VCRUNTIME140.dll "C:\Apache24\bin\VCRUNTIME140.dll"
The planted DLL fires on the next Apache service restart. On a production server, this happens via:
httpd -k restart)After restart, httpd.exe loads our proxy DLL as SYSTEM. The DllMain payload executes:
Administrators group21 system DLLs loaded by httpd.exe are not in the KnownDLLs registry key and can be hijacked from C:\Apache24\bin\:
| DLL | KnownDLL | Hijackable |
|---|---|---|
| VCRUNTIME140.dll | No | Yes — exploited |
| ucrtbase.dll | No | Yes |
| KERNELBASE.dll | No | Yes |
| bcrypt.dll | No | Yes |
| msvcp_win.dll | No | Yes |
| CRYPTSP.dll | No | Yes |
| rsaenh.dll | No | Yes |
| CRYPTBASE.dll | No | Yes |
| bcryptPrimitives.dll | No | Yes |
| mswsock.dll | No | Yes |
| napinsp.dll | No | Yes |
| DNSAPI.dll | No | Yes |
| IPHLPAPI.DLL | No | Yes |
| winrnr.dll | No | Yes |
| nlansp_c.dll | No | Yes |
| wshbth.dll | No | Yes |
| rasadhlp.dll | No | Yes |
| fwpuclnt.dll | No | Yes |
| ntdll.dll | No | Yes |
| win32u.dll | No | Yes |
| gdi32full.dll | No | Yes |
A standard user cannot self-trigger the Apache restart on a default Windows Server 2022 configuration. 16+ methods were exhaustively tested — all failed:
TerminateProcess on httpd PIDs → ACCESS_DENIEDnet stop/start Apache24 → SDDL denies RP/WP to interactive/service logonsc stop Apache24 → Access Deniedhttpd -k restart → SCM access deniedSeShutdownPrivilege not heldschtasks /ru SYSTEM → requires adminThe trigger comes from routine server maintenance, which is inevitable on any production system.
Immediate (manual):
icacls "C:\Apache24" /remove:g "BUILTIN\Users" /T
icacls "C:\Apache24" /grant "BUILTIN\Users:(OI)(CI)(RX)" /T
Permanent: Update to Apache Lounge 2.4.68-260920 or later, which ships with corrected installer ACLs.
Defense in depth: Deploy process mitigation policies to restrict DLL loading to signed binaries.
| File | Description |
|---|---|
vcruntime140_hijack.c | Proxy DLL source — DllMain payload + proof-of-concept |
vcruntime140.def | Export forwarder definitions (71 exports → vcruntime140_orig.dll) |
deploy_hijack.bat | Automated deployment script |
| Date | Event |
|---|---|
| 2026-09-20 | Apache Lounge releases 2.4.68-260920 with ACL fix |
| 2026-09-22 | CVE-2026-89282 published by CERT/CC |
| 2026-10-16 | Independent discovery + full PoC (this work) |
| 2026-10-17 | Confirmed as duplicate of CVE-2026-89282; public release |
This PoC is released for educational and authorized security testing purposes only. MIT License.
Independently discovered and documented by @D0rkerDevil. Full exploitation chain developed before learning of CVE-2026-89282.