A vulnerability has been discovered in the free archiver 7-Zip (CVE-2022-29072) that allows arbitrary commands to be executed with SYSTEM privileges by moving a specially crafted file with a .7z extension to the area with a prompt shown when opening the 'Help>Contents' menu. The issue occurs only on the Windows platform and is caused by a combination of incorrect configuration of the 7z.dll library and buffer overflow.
Interestingly, after being notified of the issue, the developers of 7-Zip did not acknowledge the vulnerability and stated that the source of the vulnerability is the Microsoft HTML Helper process (hh.exe), which executes code when a file is moved. The researcher who identified the vulnerability believes that hh.exe is only indirectly involved in exploiting the vulnerability, and the command specified in the exploit is executed in 7zFM.exe as a child process. The potential for command injection attacks is attributed to a buffer overflow in the 7zFM.exe process and incorrect configuration of permissions for the 7z.dll library.
As an example, a help file that launches 'cmd.exe' has been demonstrated. An exploit is also reported to be in preparation that allows obtaining SYSTEM privileges in Windows, but its code is planned to be published after the release of the 7-Zip update that addresses the vulnerability. Since the patches have not yet been released, a workaround suggested is to limit the 7-Zip program to read and execute access only.
Source: opennet.ru
