{"id":103811,"date":"2022-04-18T15:36:44","date_gmt":"2022-04-18T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-7-zip-pozvolyayushhaya-poluchit-privilegii-system-v-windows"},"modified":"2022-04-18T15:36:44","modified_gmt":"2022-04-18T13:36:44","slug":"uyazvimost-v-7-zip-pozvolyayushhaya-poluchit-privilegii-system-v-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-7-zip-pozvolyayushhaya-poluchit-privilegii-system-v-windows","title":{"rendered":"A vulnerability in 7-Zip that allows gaining SYSTEM privileges in Windows.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been discovered in the free archiver 7-Zip (CVE-2022-29072), which allows arbitrary commands to be executed with SYSTEM privileges by moving a specially crafted file with a .7z extension into the area of the prompt displayed when opening the \u2018Help > Contents\u2019 menu. The issue only manifests on the Windows platform and is caused by a combination of incorrect configuration of the 7z.dll library and buffer overflow. <\/p>\n
Interestingly, after being notified of the issue, the developers of 7-Zip did not acknowledge the vulnerability and stated that the source of the vulnerability is the Microsoft HTML Helper process (hh.exe), which executes code when a file is moved. The researcher who identified the vulnerability believes that hh.exe is only indirectly involved in exploiting the vulnerability, and the command specified in the exploit is executed in 7zFM.exe as a child process. The potential for command injection attacks is attributed to a buffer overflow in the 7zFM.exe process and incorrect configuration of permissions for the 7z.dll library. <\/p>\n
As an example, a help file was demonstrated that launches \u2018cmd.exe\u2019. An exploit has also been reported that allows obtaining SYSTEM privileges in Windows, but its code is expected to be published after the release of the 7-Zip update that addresses the vulnerability. Since fixes have not yet been published, a workaround suggested is to limit the 7-Zip program to read and execute access only.