ExploitCVE-2024-7262
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library.
Impact
This vulnerability has a critical severity with a CVSS v4 base score of 9.3. The impact is severe as it allows an attacker to execute arbitrary code with the privileges of the user running the application. This can lead to complete compromise of the system's confidentiality, integrity, and availability. The attack vector is local, requires low complexity, and only passive user interaction (a single click), making it relatively easy to exploit. The vulnerability affects the vulnerable system's confidentiality, integrity, and availability, all rated as HIGH. Additionally, it can impact subsequent systems with HIGH confidentiality, integrity, and availability risks, indicating potential for lateral movement or further exploitation.
Exploitation
There is no evidence that a public proof-of-concept exists. The vulnerability is actively being exploited in the wild and was added to the CISA Known Exploited Vulnerability list. Its exploitation has been reported by various sources, including securityonline.info. Malware such as SpyGlace (source:HackYourMom) are known to have weaponized this vulnerability. Threat Actor APT-C-60 (source:Vulnerability Archives • Cybersecurity News) has been identified as exploiting this vulnerability.
Patch
A patch is available. The vulnerability affects Kingsoft WPS Office versions from 12.2.0.13110 to 12.2.0.13489 on Windows. Users and administrators should apply the patch as soon as possible. The patch information can be found at https://www.wps.com/whatsnew/pc/20240422/
Mitigation
Until the patch is applied, consider the following mitigation strategies: 1. Restrict use of Kingsoft WPS Office, especially versions 12.2.0.13110 to 12.2.0.13489 on Windows systems. 2. Implement strict access controls and principle of least privilege to limit potential impact. 3. Educate users about the risks of opening untrusted documents or clicking on suspicious links within documents. 4. Use application whitelisting to prevent execution of unauthorized libraries. 5. Monitor for suspicious activities related to promecefpluginhost.exe. 6. Consider using alternative office suite software until the vulnerability is patched. 7. Implement network segmentation to limit the potential spread if a system is compromised. 8. Regularly backup important data to mitigate potential data loss.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X
Timeline
Feedly found the first article mentioning CVE-2024-7262. See article
Feedly estimated the CVSS score as HIGH
Attacks in the wild have been reported by Vulnerability Archives • Cybersecurity News. See article
CVE-2024-7262 is a critical code execution vulnerability in WPS Office for Windows, exploited in the wild by APT-C-60 to target East Asian countries. The exploit was stealthy, leveraging a zero-day flaw and a subsequent logic bug, with a patch only partially addressing the issue. Users are urged to update WPS Office immediately to mitigate the risk of further exploitation and potential downstream impacts on third-party vendors. See article
The vulnerability is known to be exploited by APT-C-60. See article
This CVE started to trend in security discussions
The vulnerability is known to be exploited by SpyGlace. See article
Detection for the vulnerability has been added to Qualys (380420)
This CVE stopped trending in security discussions