CVE-2024-57096

Executive Summary

CVE-2024-57096 is a local information disclosure vulnerability in WPS Office (formerly Kingsoft Office) versions prior to v.19302. The flaw allows a local attacker to obtain sensitive information by crafting a malicious file that, when opened by a victim, leaks data from the system. The vulnerability is classified as a local attack vector, requiring user interaction (opening a crafted file). No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not released an official patch, and the CVSS score is currently unassigned (0.0). The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

WPS Office is a proprietary office suite distributed via official channels (e.g., wps.com, app stores). This vulnerability does not affect open-source packages (NPM, PyPI, Go, Ruby). However, organizations using WPS Office should treat this as a supply chain risk due to the lack of a patch and the potential for malicious document-based attacks.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (UNKNOWN). Based on the description, a plausible CVSS vector would be:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no privileges needed to trigger.
• User Interaction (UI): Required (R) – victim must open the crafted file.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – sensitive information is disclosed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Plausible CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Threat Level: Medium (due to local access requirement and user interaction).

Deep Dive & Mechanics

The vulnerability resides in WPS Office's file parsing engine. When a specially crafted file (e.g., a DOCX, XLSX, or PPTX) is opened, the application fails to properly sanitize external entity references or embedded objects. This allows an attacker to include references to local files (e.g., /etc/passwd, C:\Users\Admin\Documents\secret.txt) that are then read and potentially exfiltrated via error messages, embedded content, or network requests.

The attack flow:

1. Attacker crafts a malicious document (e.g., using XML External Entity (XXE) injection or embedded OLE objects).
2. Victim opens the document in WPS Office.
3. WPS Office processes the malicious content, reading local files.
4. The content of those files is either displayed to the victim (information disclosure) or sent to an attacker-controlled server (exfiltration).

This is a classic local file inclusion (LFI) via document parsing, similar to vulnerabilities found in other office suites.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerability likely involves improper handling of XML external entities or embedded objects.

Vulnerable Code (Conceptual):

// Vulnerable: Parses XML without disabling external entities
void ParseDocument(const std::string& xmlContent) {
    xmlDocPtr doc = xmlParseMemory(xmlContent.c_str(), xmlContent.size());
    // No call to xmlSetExternalEntityLoader or disabling DTD
    // This allows XXE attacks
}

Patched Code (Expected):

// Patched: Disables external entity loading
void ParseDocument(const std::string& xmlContent) {
    xmlDocPtr doc = xmlParseMemory(xmlContent.c_str(), xmlContent.size());
    // Disable external entities
    xmlSetExternalEntityLoader(NoExternalEntityLoader);
    // Or use xmlCtxtUseOptions with XML_PARSE_NOENT | XML_PARSE_DTDLOAD disabled
}

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Windows 10/11 with WPS Office v.19301 or earlier.
• Attacker: Kali Linux or any system with document creation tools.

Exploitation Steps:

1. Create a malicious DOCX file with an embedded XXE payload.
2. Use a tool like xxe-injector or manually craft the XML.

Example Malicious Document (Conceptual):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///C:/Windows/win.ini">
]>
<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
  <w:body>
    <w:p>
      <w:r>
        <w:t>&xxe;</w:t>
      </w:r>
    </w:p>
  </w:body>
</w:document>

3. Send the file to the victim via email or other means.
4. When the victim opens the file, the content of C:\Windows\win.ini is displayed in the document.

Note: No public exploit code is available. This is a conceptual example.

Blue Team

Detection:

• Monitor for WPS Office processes (wps.exe, et.exe, wpp.exe) reading unusual files (e.g., C:\Windows\System32\config\SAM, /etc/shadow).
• Use Sysmon to log file access events (Event ID 11) and process creation (Event ID 1).
• Look for WPS Office making outbound connections after opening a document (potential exfiltration).

Hunting Query (KQL):

DeviceProcessEvents
| where FileName in~ ("wps.exe", "et.exe", "wpp.exe")
| where ProcessCommandLine contains ".docx" or ProcessCommandLine contains ".xlsx"
| join kind=inner (
    DeviceFileEvents
    | where FileName in~ ("win.ini", "passwd", "shadow", "config")
) on DeviceId
| project Timestamp, DeviceName, ProcessCommandLine, FileName, FolderPath

Indicators of Compromise (IOCs)

• File Hashes (MD5): None available (no known samples).
• Network Indicators: Outbound connections to attacker-controlled IPs after document opening.
• Process Anomalies: WPS Office processes (wps.exe, et.exe, wpp.exe) reading sensitive system files.
• Registry Keys (Windows): HKCU\Software\Kingsoft\Office\ – may contain traces of malicious document paths.

Detection Engineering

YARA Rule

rule CVE_2024_57096_WPS_Office_XXE {
    meta:
        description = "Detects malicious documents targeting CVE-2024-57096 in WPS Office"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-57096"
    strings:
        $xxe1 = "<!ENTITY" ascii wide nocase
        $xxe2 = "SYSTEM" ascii wide nocase
        $xxe3 = "file:///" ascii wide nocase
        $wps_magic = { 50 4B 03 04 } // ZIP magic (DOCX/XLSX/PPTX)
    condition:
        $wps_magic at 0 and all of ($xxe*)
}

Sigma Rule

title: CVE-2024-57096 - WPS Office Local File Disclosure via Malicious Document
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects WPS Office processes reading sensitive system files, indicating exploitation of CVE-2024-57096.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57096
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\wps.exe'
            - '\et.exe'
            - '\wpp.exe'
        TargetFilename|contains:
            - '\Windows\System32\config\'
            - '\Windows\win.ini'
            - '\etc\passwd'
            - '\etc\shadow'
    condition: selection
falsepositives:
    - Legitimate use of WPS Office to open system files (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-57096 - WPS Office Potential Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/exfil"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade WPS Office to version 19302 or later (if available). Check the vendor's website for updates.
2. Disable DTD processing in WPS Office if configurable (via registry or settings).
3. Restrict document opening from untrusted sources (e.g., email attachments, downloads).
4. Use application whitelisting to block WPS Office from accessing sensitive files.

Long-term:

• Monitor vendor advisories for a patch.
• Implement endpoint detection and response (EDR) to detect anomalous file access.
• Educate users on the risks of opening documents from unknown senders.

Workaround:

• Use an alternative office suite (e.g., LibreOffice) until a patch is released.

Valters IT
Securing Digital Frontiers