CVE-2024-7263: Kingsoft WPS Office Path Traversal Flaw

CVE-2024-7263 Overview

CVE-2024-7263 is an improper path validation vulnerability in promecefpluginhost.exe within Kingsoft WPS Office. This vulnerability affects WPS Office versions ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows systems and allows an attacker to load an arbitrary Windows library. Notably, the patch released in version 12.1.0.17119 to address CVE-2024-7262 was not restrictive enough—another parameter was not properly sanitized, which leads to the execution of an arbitrary Windows library.

Critical Impact

This vulnerability enables arbitrary library loading, potentially allowing attackers to execute malicious code on affected systems through improper path validation bypass.

Affected Products

• Kingsoft WPS Office versions 12.2.0.13110 to 12.2.0.17115 (exclusive)
• Microsoft Windows operating systems running affected WPS Office versions

Discovery Timeline

• August 15, 2024 - CVE-2024-7263 published to NVD
• April 24, 2025 - Last updated in NVD database

Technical Details for CVE-2024-7263

Vulnerability Analysis

This vulnerability stems from insufficient input validation in the promecefpluginhost.exe component of Kingsoft WPS Office. The flaw is classified as CWE-22 (Path Traversal), where improper handling of path parameters allows attackers to bypass security restrictions and load arbitrary Windows libraries.

The vulnerability represents an incomplete fix for the previously disclosed CVE-2024-7262. While the original patch attempted to sanitize input parameters, it failed to adequately restrict all potentially dangerous parameters. This oversight means that attackers who were aware of CVE-2024-7262 could analyze the patch and identify an alternative exploitation path through the unsanitized parameter.

The local attack vector requires user interaction, typically achieved through social engineering tactics such as convincing a user to open a malicious document or click a specially crafted link. Once triggered, the vulnerability allows loading of attacker-controlled DLL files, leading to arbitrary code execution within the context of the WPS Office process.

Root Cause

The root cause of CVE-2024-7263 lies in incomplete input sanitization within the promecefpluginhost.exe executable. While Kingsoft addressed one vulnerable parameter in their initial patch for CVE-2024-7262, they failed to identify and sanitize an additional parameter that could be manipulated to achieve the same malicious outcome—loading arbitrary Windows libraries. This represents a common pattern in vulnerability remediation where patch coverage is insufficient to address all potential attack vectors.

Attack Vector

The attack requires local access and user interaction to exploit. An attacker can craft a malicious document or leverage other social engineering techniques to trigger the vulnerability. When a user opens the malicious content, the improperly validated path parameter in promecefpluginhost.exe allows the attacker to specify and load a malicious DLL from an arbitrary location. This arbitrary library loading effectively grants the attacker code execution capabilities with the same privileges as the WPS Office process.

The exploitation mechanism involves manipulating path parameters to bypass the application's intended library loading restrictions. Due to insufficient validation, specially crafted path strings can traverse directories or reference attacker-controlled locations, enabling the loading of malicious Windows DLL files.

Detection Methods for CVE-2024-7263

Indicators of Compromise

• Unusual DLL loading activity by promecefpluginhost.exe from non-standard directories
• Suspicious process behavior from WPS Office components attempting to access unexpected file paths
• Evidence of path traversal sequences in process arguments or file access logs
• Unexpected child processes spawned by WPS Office executables

Detection Strategies

• Monitor promecefpluginhost.exe for abnormal library loading patterns, particularly DLLs loaded from user-writable directories
• Implement application whitelisting to detect unauthorized DLL loading attempts
• Deploy endpoint detection rules to identify path traversal patterns in WPS Office process arguments
• Analyze file access logs for suspicious path manipulation attempts targeting WPS Office components

Monitoring Recommendations

• Enable enhanced process creation logging to capture command-line arguments for WPS Office executables
• Configure DLL load monitoring on endpoints running affected WPS Office versions
• Establish baseline behavior for promecefpluginhost.exe to identify anomalous activity
• Implement file integrity monitoring for WPS Office installation directories

How to Mitigate CVE-2024-7263

Immediate Actions Required

• Update Kingsoft WPS Office to version 12.2.0.17119 or later immediately
• Audit systems for vulnerable WPS Office installations and prioritize patching
• Restrict user permissions to minimize the impact of potential exploitation
• Educate users about the risks of opening untrusted documents

Patch Information

Kingsoft has released a security update to address this vulnerability. Users should update to WPS Office version 12.2.0.17119 or later, which includes proper sanitization for the previously vulnerable parameter. For detailed patch information, refer to the WPS Security Update Announcement.

Workarounds

• Implement application control policies to restrict DLL loading from non-standard locations
• Use endpoint protection solutions to monitor and block suspicious library loading behavior
• Consider temporarily uninstalling or disabling WPS Office on critical systems until patching is complete
• Deploy network segmentation to limit potential lateral movement if exploitation occurs

# Configuration example - Verify WPS Office version on Windows
# Run in Command Prompt or PowerShell to check installed version
wmic product where "name like 'WPS Office%%'" get name,version

# PowerShell alternative for version verification
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object {$_.DisplayName -like "*WPS Office*"} | Select-Object DisplayName,DisplayVersion