A vulnerability has been identified in the free archiver 7-Zip (CVE-2022-29072), which allows arbitrary commands to be executed with SYSTEM privileges by moving a specially crafted file with the .7z extension into the area with the prompt shown when opening the 'Help>Contents' menu. The issue only manifests on the Windows platform and is caused by a combination of incorrect configuration of the 7z.dll library and a buffer overflow.
Notably, after being informed about the issue, the developers of 7-Zip did not acknowledge the vulnerability and stated that the source of the vulnerability is the Microsoft HTML Helper process (hh.exe), which executes code when moving a file. The researcher who identified the vulnerability believes that hh.exe only indirectly participates in exploiting the vulnerability, as the command specified in the exploit runs in 7zFM.exe as a child process. The causes of the ability to conduct an attack through command injection are said to be a buffer overflow in the 7zFM.exe process and incorrect rights configuration for the 7z.dll library.
An example has been demonstrated with a help file that launches 'cmd.exe'. It has also been stated that an exploit is being prepared that will allow obtaining SYSTEM privileges in Windows, but its code is planned to be published after the release of a 7-Zip update that fixes the vulnerability. As a temporary workaround for protection, it is suggested to limit the 7-Zip program's access to read and execute only.
Forrás: opennet.ru
