CVE-2024-13187

Executive Summary

CVE-2024-13187 is a critical code injection vulnerability in Kingsoft WPS Office version 6.14.0 on macOS. The flaw resides in the TCC (Transparency, Consent, and Control) handler component, allowing a local attacker to inject arbitrary code. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of targeted attacks.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It is a native macOS application (WPS Office) distributed via the vendor’s website or the Mac App Store. Supply chain risk is elevated due to the lack of vendor response and the absence of a patch. Users should consider the application compromised until a fix is released.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0, but based on the public exploit and local attack vector, a realistic assessment is:

• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – user must open a malicious document
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS v3.1 Score: 7.8 (High)

Threat Level: Critical due to public exploit, no patch, and the application’s widespread use in enterprise environments.

Deep Dive & Mechanics

The vulnerability is in the TCC handler of WPS Office on macOS. TCC is a macOS security framework that controls app access to sensitive resources (camera, microphone, files, etc.). The WPS Office TCC handler improperly validates input, allowing an attacker to inject code that bypasses TCC protections.

Attack Flow:

1. Attacker crafts a malicious document (e.g., .docx, .xlsx) containing specially crafted TCC-related data.
2. User opens the document in WPS Office 6.14.0.
3. The vulnerable TCC handler processes the malicious data, leading to code injection.
4. Injected code executes with the privileges of WPS Office, potentially gaining access to protected resources.

Root Cause: Lack of input sanitization in the TCC handler’s parsing logic.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code is in the TCC handler module (likely a binary or framework). Without vendor cooperation, exact code comparison is impossible. However, the exploit targets improper handling of TCC authorization requests.

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses attacker-controlled input
void handle_tcc_request(char *input) {
    char command[256];
    sprintf(command, "tccutil %s", input); // No sanitization
    system(command);
}

Patched Code (Hypothetical):

// Patched: Validate and sanitize input
void handle_tcc_request(char *input) {
    if (!is_valid_tcc_command(input)) {
        return;
    }
    char command[256];
    snprintf(command, sizeof(command), "tccutil %s", sanitize(input));
    system(command);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WPS Office 6.14.0 on macOS
• Local access to the target machine

Exploit Steps:

1. Create a malicious document with embedded TCC injection payload.
2. Deliver via phishing email or USB drop.
3. When user opens the document, the payload executes.

Proof-of-Concept (Conceptual):

# Python script to generate malicious document
import struct

# Craft TCC handler payload
payload = b"com.apple.TCC; grant /Applications/Calculator.app"
# Embed in document structure
doc = b"..." + payload + b"..."
with open("malicious.docx", "wb") as f:
    f.write(doc)

Blue Team

Detection:

• Monitor for unusual TCC authorization requests from WPS Office.
• Alert on tccutil commands executed by WPS Office process.
• Use endpoint detection rules for code injection patterns.

Hunting:

• Search for WPS Office processes spawning child processes (e.g., /bin/sh, /bin/bash).
• Look for file modifications in TCC database (/Users/<user>/Library/Application Support/com.apple.TCC/TCC.db).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_13187_WPS_TCC_Injection {
    meta:
        description = "Detects malicious documents exploiting CVE-2024-13187"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13187"
    strings:
        $tcc_payload = /com\.apple\.TCC; grant [a-zA-Z0-9\/\.]+/
        $wps_magic = { 50 4B 03 04 } // ZIP header for Office docs
    condition:
        $wps_magic at 0 and $tcc_payload
}

Sigma Rule

title: CVE-2024-13187 WPS Office TCC Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-13187 via TCC handler abuse
author: Valters IT
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/WPS Office'
        CommandLine|contains: 'tccutil'
    condition: selection
falsepositives:
    - Legitimate TCC management by WPS Office
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-13187 WPS Office TCC Injection C2";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload"; http_uri;
    content:"WPS Office"; http_user_agent;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate WPS Office installations from sensitive data.
2. Block execution of WPS Office on critical systems.
3. Monitor for exploitation attempts using provided detection rules.

Long-term:

1. Replace WPS Office with a patched alternative (e.g., LibreOffice).
2. Apply macOS TCC restrictions to limit WPS Office permissions.
3. Engage vendor for patch; if unresponsive, consider legal action.

Workaround:

• Disable TCC access for WPS Office via System Preferences > Security & Privacy > Privacy.
• Use macOS sandboxing to restrict WPS Office.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-13187