CVE-2024-56957

Executive Summary

CVE-2024-56957 is a security advisory concerning Kingsoft WPS Office for iOS version 12.20.0. The vulnerability allows an attacker to access sensitive user information by supplying a crafted link. This is a client-side attack vector that likely involves the WPS Office application improperly handling URL schemes or deep links, leading to information disclosure. The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been assigned by NVD at this time. No public proof-of-concept, exploit code, or patch details are currently available. The EPSS score is 0.0%, suggesting a very low probability of exploitation in the wild at the time of analysis.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary iOS application distributed through the Apple App Store. Supply chain risk is limited to the integrity of the application binary and its update mechanism.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unassigned) CVSS Vector: UNKNOWN

Due to the lack of a CVSS vector, a full breakdown is not possible. However, based on the description, the following can be inferred:

• Attack Vector (AV): Network (likely, as it involves a crafted link).
• Attack Complexity (AC): Low (a crafted link is a simple attack).
• Privileges Required (PR): None (attacker does not need prior access).
• User Interaction (UI): Required (user must click the link).
• Scope (S): Unchanged (likely).
• Confidentiality (C): High (sensitive user information is accessed).
• Integrity (I): None (no modification mentioned).
• Availability (A): None (no denial of service mentioned).

Threat Level: Medium to High (depending on the sensitivity of the information exposed). The lack of a patch and public exploit increases the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the URL handling mechanism of WPS Office for iOS version 12.20.0. The application likely registers custom URL schemes (e.g., wps://, kingsoftoffice://) or handles universal links. When a user clicks a crafted link, the application may:

1. Parse the link parameters without proper validation.
2. Execute an action that exposes local files, documents, or authentication tokens.
3. Leak sensitive data via the link response or through a side channel.

The attack flow:

1. Attacker crafts a malicious URL targeting the WPS Office URL scheme.
2. Attacker delivers the link via phishing email, SMS, or social media.
3. User clicks the link on an iOS device with WPS Office 12.20.0 installed.
4. WPS Office processes the link and inadvertently exposes sensitive user data (e.g., recent documents, cloud storage tokens, or local file paths).

Vulnerable vs. Patched Code

No patch or patched code is available for analysis. The vulnerable code is within the proprietary WPS Office iOS application. The fix would likely involve:

• Input validation and sanitization of URL parameters.
• Restricting the actions that can be triggered via URL schemes.
• Implementing proper permission checks before accessing sensitive data.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate extraction of a user's WPS Office cloud storage token.

Prerequisites:

• iOS device or simulator running WPS Office 12.20.0.
• A crafted URL.

Steps:

1. Identify the URL scheme used by WPS Office (e.g., wps://).
2. Craft a URL that triggers a file listing or token retrieval. Example (hypothetical):

   wps://open?file=../../Library/Application%20Support/com.kingsoft.wps.ios/token.plist
   

3. Deliver the link to the target via a phishing email.
4. When the user clicks the link, WPS Office opens and attempts to process the path traversal.
5. The application may display the token or send it to an attacker-controlled server via a callback.

Note: This is a hypothetical exploitation scenario. Actual exploitation details are unknown.

Blue Team

Objective: Detect and block exploitation attempts.

Detection:

• Monitor for unusual URL scheme invocations on iOS devices (requires MDM or EDR).
• Analyze network traffic for outbound connections from WPS Office to unknown IPs after a link click.
• Use phishing awareness training to educate users about suspicious links.

Mitigation:

• Block or restrict the use of WPS Office until a patch is available.
• Implement application allowlisting on managed devices.
• Use iOS URL filtering to block known malicious domains.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): UNKNOWN (no malicious files identified).
• Domains: UNKNOWN (no specific domains reported).
• IP Addresses: UNKNOWN.
• URL Patterns:
  • wps://* (any URL using the WPS Office scheme)
  • kingsoftoffice://*
• Process Names: WPS Office.app
• Registry/File Paths: UNKNOWN (iOS sandboxed environment).

Detection Engineering

YARA Rule

rule CVE_2024_56957_WPS_Office_iOS_Info_Disclosure {
    meta:
        description = "Detects potential exploitation of CVE-2024-56957 via crafted URLs in WPS Office for iOS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56957"
        hash = "UNKNOWN"
    strings:
        $url_scheme = "wps://" ascii wide nocase
        $url_scheme2 = "kingsoftoffice://" ascii wide nocase
        $sensitive_path = "token" ascii wide nocase
        $sensitive_path2 = "credentials" ascii wide nocase
    condition:
        any of ($url_scheme*) and any of ($sensitive_path*)
}

Sigma Rule

title: CVE-2024-56957 - WPS Office iOS Information Disclosure via Crafted Link
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56957 by monitoring for suspicious URL scheme invocations.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56957
logsource:
    product: ios
    service: unified_log
detection:
    selection:
        eventType: "com.apple.springboard.urlhandler"
        url|contains|all:
            - "wps://"
            - "token"
    condition: selection
falsepositives:
    - Legitimate use of WPS Office URL schemes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56957 - WPS Office iOS Information Disclosure Attempt"; flow:to_server,established; content:"wps://"; http_uri; content:"token"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Uninstall or disable WPS Office for iOS version 12.20.0 until a patch is released.
2. Vendor Patch: Monitor Kingsoft's official channels for a security update. Apply the patch as soon as it becomes available.
3. User Awareness: Educate users not to click on suspicious links, especially those involving WPS Office URL schemes.
4. Network Controls: Implement web filtering to block known malicious domains and URL patterns.
5. Mobile Device Management (MDM): Use MDM to enforce application blacklisting and restrict URL scheme handling.
6. Alternative Software: Consider using alternative office applications that are actively maintained and patched.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert