JetBrains PyCharm Professional 2016.1.4 DLL Hijacking

`Aloha,  
  
*pycharm-professional-2016.1.4.exe* loads and executes dwmapi.dll from its  
"application directory".  
  
For software downloaded with a web browser the applicationdirectory is  
typically the user's "Downloads" directory: see <  
https://insights.sei.cmu.edu/cert/2008/09/carpet-bombing-and-directory-poisoning.html  
>,  
<http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html  
>  
and <http://seclists.org/fulldisclosure/2012/Aug/134> for "prior art" about  
this well-known and well-documented vulnerability.  
  
  
If an attacker places one of the above named DLL in the user's "Downloads"  
directory (for example per "drive-by download" or "social engineering")  
this vulnerability becomes a remote code execution.  
  
  
Proof of concept/demonstration:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
1. Create malicious dll file and save it as dwmapi.dll in your "Downloads"  
directory.  
  
2. Download pycharm-professional-2016.1.4.exe from  
https://www.jetbrains.com/pycharm/download/#section=windows  
and save it in your "Downloads" directory.  
  
3. Execute pycharm-professional-2016.1.4.exe from your "Downloads"  
directory.  
  
4. Malicious dll file gets executed.  
  
Chao!!  
Himanshu Mehta  
`