SQ14151
Detected Windows executable files that load dynamic libraries from network or remote server location.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | high | medium | 3 | hardening: fail Reason: unsafe dependency references |
About the issue
Windows applications reference shared functions from the operating system (and other libraries) by importing their publicly available symbols. This modularization greatly reduces the time required to develop software, as common operations can be referenced without having to rewrite them every time they are needed. Applications can load additional libraries during their initialization sequence or their execution. In both cases, the Portable Executable (PE) file format provides the mechanisms to acquire required libraries and their public symbols. Since those libraries contain code, they must be loaded from a trusted source. If the libraries are hosted on a remote server, their code could be changed or intercepted by a malicious binary planting attack.
How to resolve the issue
- Ensure that your application loads all required libraries from the same machine where the application itself resides.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- A journey across static and dynamic libraries (External resource - internalpointers)
- A brief introduction to PE format (External resource - Medium)
- Binary Planting (External resource - OWASP)