Kingsoft WPS Office up to 12.2.0.13489 on Windows promecefpluginhost.exe path traversal

Summaryinfo

A vulnerability was found in Kingsoft WPS Office up to 12.2.0.13489 on Windows and classified as critical. This issue affects some unknown processing of the file promecefpluginhost.exe. The manipulation results in path traversal. This vulnerability is known as CVE-2024-7263. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Kingsoft WPS Office up to 12.2.0.13489 on Windows. It has been classified as critical. Affected is an unknown code of the file promecefpluginhost.exe. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitigate CVE-2024-7262 was not restrictive enough. Another hyperlink parameter was not properly sanitized which leads to the execution of an arbitrary Windows library.

The weakness was published by Romain Dumont. The advisory is shared for download at wps.com. This vulnerability is traded as CVE-2024-7263 since 07/30/2024. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

It is declared as attacked.

Upgrading to version 12.2.0.17153 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (907). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Office Suite Software

Vendor

• Kingsoft

Name

• WPS Office

Version

• 12.2.0.13489

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion