jvndb - jvndb-2024-000098

jvndb-2024-000098

Vulnerability from jvndb

Published

2024-09-06 15:07

Modified

2024-09-06 15:07

Severity

7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Multiple products from KINGSOFT JAPAN vulnerable to path traversal

Details

KINGSOFT JAPAN, INC. provides Kingsoft Office Software's WPS Office and its related products localized for Japan.<br /> WPS Office and its related products provided by KINGSOFT JAPAN, INC. contain a path traversal vulnerability (CWE-22, CVE-2024-7262, CVE-2024-7263)) due to inadequate file path validation by promecefpluginhost.exe.<br /> Note that, a report has been published describing that "WPS Office provided by Kingsoft Office Software is affected to this vulnerability and exploitation is observed".<br /> KINGSOFT JAPAN, INC. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and KINGSOFT JAPAN, INC. coordinated under the Information Security Early Warning Partnership.

References

Type	URL
JVN	https://jvn.jp/en/jp/JVN32529796/index.html
CVE	https://www.cve.org/CVERecord?id=CVE-2024-7262
CVE	https://www.cve.org/CVERecord?id=CVE-2024-7263
Related document	https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/
Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor	Product
KINGSOFT, INC.	KINGSOFT PDF Pro
KINGSOFT, INC.	WPS Cloud
KINGSOFT, INC.	WPS Cloud Pro
KINGSOFT, INC.	WPS Office2 for Windows

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000098.html",
  "dc:date": "2024-09-06T15:07+09:00",
  "dcterms:issued": "2024-09-06T15:07+09:00",
  "dcterms:modified": "2024-09-06T15:07+09:00",
  "description": "KINGSOFT JAPAN, INC. provides Kingsoft Office Software\u0026#39;s WPS Office and its related products localized for Japan.\u003cbr /\u003e\r\nWPS Office and its related products provided by KINGSOFT JAPAN, INC. contain a path traversal vulnerability (CWE-22, CVE-2024-7262, CVE-2024-7263)) due to inadequate file path validation by promecefpluginhost.exe.\u003cbr /\u003e\r\n\r\nNote that, a report has been published describing that \u0026quot;WPS Office\u0026nbsp;provided by Kingsoft Office Software is affected to this vulnerability and exploitation is observed\u0026quot;.\u003cbr /\u003e\r\n\r\nKINGSOFT JAPAN, INC. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and KINGSOFT JAPAN, INC. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000098.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:kingsoft:pdf_pro",
      "@product": "KINGSOFT PDF Pro",
      "@vendor": "KINGSOFT, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:kingsoft:wps_cloud",
      "@product": "WPS Cloud",
      "@vendor": "KINGSOFT, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:kingsoft:wps_cloud_pro",
      "@product": "WPS Cloud Pro",
      "@vendor": "KINGSOFT, INC.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:kingsoft:wps_office2_for_Windows",
      "@product": "WPS Office2 for Windows",
      "@vendor": "KINGSOFT, INC.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000098",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN32529796/index.html",
      "@id": "JVN#32529796",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-7262",
      "@id": "CVE-2024-7262",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-7263",
      "@id": "CVE-2024-7263",
      "@source": "CVE"
    },
    {
      "#text": "https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/",
      "@id": "Analysis of two arbitrary code execution vulnerabilities affecting WPS Office",
      "@source": "Related document"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "Multiple products from KINGSOFT JAPAN vulnerable to path traversal"
}

cve-2024-7263

Vulnerability from cvelistv5

Published

2024-08-15 14:29

Modified

2024-08-22 05:46

Severity

9.3 (Critical) - cvssV4_0 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N

Summary

Arbitrary Code Execution in WPS Office

References

URL	Tags
https://www.wps.com/whatsnew/pc/20240422/

Impacted products

Vendor	Product
Kingsoft	WPS Office

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kingsoft:wps_office:12.2.0.13110:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wps_office",
            "vendor": "kingsoft",
            "versions": [
              {
                "lessThanOrEqual": "12.2.0.17153",
                "status": "affected",
                "version": "12.2.0.13110",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7263",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-16T13:36:15.984437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-16T13:38:20.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.wps.com/",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "WPS Office",
          "vendor": "Kingsoft",
          "versions": [
            {
              "changes": [
                {
                  "at": "12.1.0.17119",
                  "status": "unaffected"
                }
              ],
              "lessThan": "12.2.0.17115",
              "status": "affected",
              "version": "12.2.0.13110",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Romain DUMONT (ESET)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper path validation in \u003cb\u003epromecefpluginhost.exe\u003c/b\u003e in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.\u003cbr\u003eThe patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library.\u003cbr\u003e"
            }
          ],
          "value": "Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.\nThe patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17: Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "A user clicking on a crafted hyperlink could lead to arbitrary code execution"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-22T05:46:47.221Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "url": "https://www.wps.com/whatsnew/pc/20240422/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to latest version\u003cbr\u003e"
            }
          ],
          "value": "Update to latest version"
        }
      ],
      "source": {
        "discovery": "USER"
      },
      "title": "Arbitrary Code Execution in WPS Office",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2024-7263",
    "datePublished": "2024-08-15T14:29:04.097Z",
    "dateReserved": "2024-07-30T07:50:57.690Z",
    "dateUpdated": "2024-08-22T05:46:47.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-7262

Vulnerability from cvelistv5

Published

2024-08-15 14:24

Modified

2024-09-03 16:20

Severity

9.3 (Critical) - cvssV4_0 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L

Summary

Arbitrary Code Execution in WPS Office

References

URL	Tags
https://www.wps.com/whatsnew/pc/20240422/

Impacted products

Vendor	Product
Kingsoft	WPS Office

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wps_office",
            "vendor": "kingsoft",
            "versions": [
              {
                "lessThan": "12.2.0.13489",
                "status": "affected",
                "version": "12.2.0.13110",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7262",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-31T03:55:30.362677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-09-03",
                "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T16:20:22.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2024-09-03T00:00:00+00:00",
            "value": "CVE-2024-7262 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.wps.com/",
          "defaultStatus": "unknown",
          "platforms": [
            "Windows"
          ],
          "product": "WPS Office",
          "vendor": "Kingsoft",
          "versions": [
            {
              "lessThan": "12.2.0.16412",
              "status": "affected",
              "version": "12.2.0.13110",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "Romain DUMONT (ESET)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper path validation in \u003cb\u003epromecefpluginhost.exe\u003c/b\u003e in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.\u003cbr\u003eThe vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library.\nThe vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Exploit found in-the-wild.\u003cbr\u003e"
            }
          ],
          "value": "Exploit found in-the-wild."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17: Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/RE:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "A user clicking on a crafted hyperlink could lead to arbitrary code execution"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-22T05:51:23.952Z",
        "orgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
        "shortName": "ESET"
      },
      "references": [
        {
          "url": "https://www.wps.com/whatsnew/pc/20240422/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to latest version\u003cbr\u003e"
            }
          ],
          "value": "Update to latest version"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_known-exploited-vulnerability"
      ],
      "title": "Arbitrary Code Execution in WPS Office",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215",
    "assignerShortName": "ESET",
    "cveId": "CVE-2024-7262",
    "datePublished": "2024-08-15T14:24:44.511Z",
    "dateReserved": "2024-07-30T07:50:53.765Z",
    "dateUpdated": "2024-09-03T16:20:22.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

jvndb-2024-000098

Vulnerability from jvndb

cve-2024-7263

Vulnerability from cvelistv5

cve-2024-7262

Vulnerability from cvelistv5

Tags