CVE-2024-7262
Kingsoft WPS Office Path Traversal Vulnerability - [Actively Exploited]
Description
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
INFO
Published Date :
Aug. 15, 2024, 3:15 p.m.
Last Modified :
Sept. 5, 2024, 1:30 p.m.
Source :
[email protected]
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
While CISA cannot confirm the effectiveness of patches at this time, it is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue the use of the product.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-7262.
| URL | Resource |
|---|---|
| https://www.wps.com/whatsnew/pc/20240422/ | Vendor Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-7262 vulnerability anywhere in the article.
-
Cybersecurity News
CVE-2024-35783 (CVSS 9.4): Critical-Severity Flaw Exposes Siemens Industrial Systems
Siemens has issued a critical security advisory regarding a remote code execution (RCE) vulnerability in several of its SIMATIC products, including SIMATIC Process Historian, SIMATIC PCS 7, and SIMATI ... Read more
-
The Register
Predator spyware updated with dangerous new features, also now harder to track
Infosec in brief After activating its chameleon field and going to ground following press attention earlier this year, the dangerous Predator commercial spyware kit is back – with upgrades. Insikt Gro ... Read more
-
Cybersecurity News
Critical Cisco SLU Vulnerabilities CVE-2024-20439 and CVE-2024-20440 Threaten Remote Admin Control
Cisco has issued a security advisory warning organizations of multiple vulnerabilities in its Smart Licensing Utility (SLU) that could allow remote attackers to access sensitive information or gain ad ... Read more
-
security.nl
VS meldt actief misbruik van kritiek path traversal-lek in WPS Office
Aanvallers maken actief misbruik van een kritieke path traversal-kwetsbaarheid in Kingsoft WPS Office, waardoor een aanvaller malafide code op het systeem van de gebruiker kan uitvoeren. Alleen het op ... Read more
-
Cybersecurity News
CISA Issues Alert: Three Actively Exploited Vulnerabilities Demand Immediate Attention
The Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, highlighting their active exploitation in the ... Read more
-
TheCyberThrone
APT-C-60 Exploits WPS Office Vulnerabilities
Security researchers from ESET have identified two vulnerabilities in WPS Office for Windows, widely exploited by the APT-C-60 cyberespionage group, which is aligned with South Korea.APT-C-60, known f ... Read more
-
Dark Reading
South Korean APT Exploits 1-Click WPS Office Bug, Nabs Chinese Intel
Source: Imaginechina Limited via Alamy Stock PhotoEarlier this year, a South Korean advanced persistent threat (APT) exploited a critical vulnerability in WPS Office to spy on high-level entities in C ... Read more
-
BleepingComputer
South Korean hackers exploited WPS Office zero-day to deploy malware
The South Korea-aligned cyberespionage group APT-C-60 has been leveraging a zero-day code execution vulnerability in the Windows version of WPS Office to install the SpyGlace backdoor on East Asian ta ... Read more
-
The Hacker News
APT-C-60 Group Exploit WPS Office Flaw to Deploy SpyGlace Backdoor
Cyber Attack / Vulnerability A South Korea-aligned cyber espionage has been linked to the zero-day exploitation of a now-patched critical remote code execution flaw in Kingsoft WPS Office to deploy a ... Read more
-
Cybersecurity News
ESET Uncovers Zero-Day Vulnerabilities in WPS Office, Exploited by APT-C-60
Overview of the exploit’s control flow | Image: ESETESET researchers have identified two severe vulnerabilities in WPS Office for Windows, widely exploited by the APT-C-60 cyberespionage group, which ... Read more
-
Cybersecurity News
CISA Warns of Actively Exploited Apache OFBiz CVE-2024-38856 Vulnerability, PoC Available
Image: securelayer7The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about an actively exploited security flaw in Apache OFBiz, a popular open-source enterp ... Read more
-
Cybersecurity News
Chinese Hackers Deploy VersaMem Web Shell via Versa Director Zero-Day (CVE-2024-39717)
Overview of the Versa Director exploitation process and the VersaMem web shell functionalityBlack Lotus Labs, a threat intelligence team within Lumen Technologies, has uncovered the active exploitatio ... Read more
-
Cybersecurity News
Zero-Click Windows RCE Threat: Researcher Publishes PoC Exploit for CVE-2024-38063
In a significant development for cybersecurity professionals, security researcher Ynwarcs has published an in-depth analysis and proof-of-concept (PoC) exploit code for a critical zero-click CVE-2024- ... Read more
-
Cybersecurity News
Microsoft, Linux, Dahua Flaws Exploited: CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert, adding four critical security vulnerabilities impacting Microsoft Exchange Server, the Linux kernel, and Da ... Read more
-
Cybersecurity News
CVE-2024-6800 (CVSS 9.5): Critical GitHub Enterprise Server Flaw Patched, Admin Access at Risk
GitHub, the world’s leading software development platform, has recently disclosed multiple security vulnerabilities in GitHub Enterprise Server (GHES) that could have allowed attackers to gain unautho ... Read more
-
Cybersecurity News
WPS Office Vulnerabilities Expose 200 Million Users: CVE-2024-7262 Exploited in the Wild
Please enable JavaScriptWPS Office, a widely used office suite with a user base exceeding 200 million, has been found to contain two critical vulnerabilities that could expose users to remote code exe ... Read more
The following table lists the changes that have been made to the
CVE-2024-7262 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Sep. 05, 2024
Action Type Old Value New Value Changed CPE Configuration AND OR *cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:* versions from (including) 12.2.0.13110 up to (including) 12.2.0.13489 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* AND OR *cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:* versions from (including) 12.2.0.13110 up to (excluding) 12.2.0.16412 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Sep. 04, 2024
Action Type Old Value New Value Added Date Added 2024-09-03 Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Kingsoft WPS Office Path Traversal Vulnerability Added Due Date 2024-09-24 -
CVE Modified by [email protected]
Aug. 22, 2024
Action Type Old Value New Value Changed Description Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 (inclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document -
Initial Analysis by [email protected]
Aug. 16, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Changed Reference Type https://www.wps.com/whatsnew/pc/20240422/ No Types Assigned https://www.wps.com/whatsnew/pc/20240422/ Vendor Advisory Added CWE NIST CWE-22 Added CPE Configuration AND OR *cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:* versions from (including) 12.2.0.13110 up to (including) 12.2.0.13489 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* -
CVE Modified by [email protected]
Aug. 16, 2024
Action Type Old Value New Value Changed Description Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library. Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 (inclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document -
CVE Received by [email protected]
Aug. 15, 2024
Action Type Old Value New Value Added Description Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library. Added Reference ESET https://www.wps.com/whatsnew/pc/20240422/ [No types assigned] Added CWE ESET CWE-22 Added CVSS V4.0 ESET CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-7262 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-7262
weaknesses.