Perl on Windows cmd.exe uncontrolled search path

Summaryinfo

A vulnerability identified as critical has been detected in Perl on Windows. The impacted element is an unknown function of the file cmd.exe. The manipulation leads to uncontrolled search path. This vulnerability is listed as CVE-2023-47039. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Perl on Windows (Programming Language Software) (affected version not known). This issue affects some unknown functionality of the file cmd.exe. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.

The weakness was presented 11/27/2023. It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2023-47039 since 10/30/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-51194). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• Perl

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion