CVE-2024-7262

Aug. 15, 2024, 5:34 p.m.

None
No Score

Description

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.13489 on Windows allows an attacker to load an arbitrary Windows library. Using the MHTML format allows an attacker to automatically deliver a malicious library on opening the document and a single user click on a crafted hyperlink leads to the execution of the library.

Product(s) Impacted

Product Versions
Kingsoft WPS Office
  • ['12.2.0.13110 - 12.2.0.13489']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://www.wps.com/whatsnew/pc/20240422/

Tags

CWE-22
security@eset.com
2024-08-15
CVE-2024-7262

Timeline

Published: Aug. 15, 2024, 3:15 p.m.
Last Modified: Aug. 15, 2024, 5:34 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@eset.com

Relations

Here is the list of observables linked to the vulnerability CVE-2024-7262 using threat intelligence.

  • APT-C-60
  • SpyGlace

Linked Attack Reports

Analysis of two arbitrary code execution vulnerabilities affecting WPS Office

ESET researchers discovered two code execution vulnerabilities in WPS Office for Windows. CVE-2024-7262 was exploited by APT-C-60, a South Korea-aligned cyberespionage group, to target East Asian countries. The vulnerability allowed arbitrary code execution via a malicious hyperlink in a spreadshee…
windows
vulnerability
plugin
CVE-2024-7262
CVE-2024-7263
2024-08-30
wps office
taskcontroler.dll
hyperlink
spyglace
spreadsheet
code execution
Published: August 30, 2024
Linked vulnerabilities : CVE-2024-7262, CVE-2024-7263, CVE-2024-7672 (CVSS 7.8), CVE-2924-7263, CVE-2022-24934
Downloadable IOCs: 5

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.