CVE-2023-47113: 
NixOS vulnerability analysis and mitigation

BleachBit, a utility that cleans files to free disk space and maintain privacy, was found to contain a DLL Hijacking vulnerability (CVE-2023-47113) affecting Windows versions up to 4.4.2. The vulnerability was discovered and disclosed on November 5, 2023, and subsequently patched in version 4.5.0 (GitHub Advisory).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element) with a CVSS v3.1 base score of 7.3 (HIGH). The vulnerability affects both bleachbit.exe and bleachbit_console.exe executables. The attack vector is local (AV:L), requiring low attack complexity (AC:L) and low privileges (PR:L), but does need user interaction (UI:R). The scope is unchanged (S:U), with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

The vulnerability has multiple potential impacts. It can be exploited for privilege escalation when BleachBit runs in an elevated context through UAC, allowing non-elevated malware to execute with elevated privileges. It can be used as a persistence mechanism, executing malicious payload every time BleachBit runs. The vulnerability enables malware evasion by executing through legitimate BleachBit processes and can facilitate malware spreading in multi-user systems (GitHub Advisory).

Several mitigation options are available: 1) Upgrade to BleachBit version 4.5.0 or later which contains the patch, 2) Upgrade to BleachBit 4.4.2.2467 (alpha) which has a proper fix due to using Python 3.10 instead of Python 3.4, 3) As an administrator, create the directory c:\DLLs with permissions that prevent regular users from creating files, which prevents non-elevated users or malware from creating the malicious DLL (GitHub Advisory).