Vulnerability description
WPS Office software is an office software package independently developed by Kingsoft Office Software Co., Ltd.
In the affected versions, there is a design flaw in the browser domain name whitelist mechanism embedded in WPS Office. An attacker could exploit this vulnerability to create malicious files.
After the victim opens the file and clicks on a picture or object with a hyperlink, the malicious code on the remote server may be downloaded to the specified directory and executed.
| Vulnerability name | Code Execution Vulnerability in WPS Office |
|---|---|
| Vulnerability type | SQL injection |
| Discovery time | 2023/8/9 |
| Vulnerability Breadth | wide |
| MPS number | MPS-3pcb-l4mv |
| CVE number | - |
| CNVD number | - |
Sphere of influence
WPS Office Personal Edition @(-∞, 12.1.0.15120]
WPS Office Organization @(-∞, 11.8.2.12085)
Repair plan
Update WPS Office Organization Edition to version 11.8.2.12085 or later
Upgrade WPS Office Personal Edition to version 12.1.0.15120 or later
Avoid clicking pictures or objects with hyperlinks
reference link
https://www.oscs1024.com/hd/MPS-3pcb-l4mv
https://security.wps.cn/notices/35
About Murphy Security
Murphy Security is a technology company that provides you with professional software supply chain security management. The core team comes from Baidu, Huawei, Wuyun and other enterprises. The company provides customers with a complete software supply chain security management platform, and provides software with a full life cycle around SBOM Security management, platform capabilities include software component analysis, source security management, container image detection, vulnerability intelligence early warning and commercial software supply chain access assessment and other products. Provide customers with complete control capabilities from supply chain asset identification management, risk detection, security control, and one-key repair.
Open source project: https://github.com/murphysecurity/murphysec/?sf=qbyj
The product can be integrated with various tools in the existing development process at a very low cost, including seamless integration with dozens of tools such as IDE, Gitlab, Bitbucket, Jenkins, Harbor, and Nexus.
Free code security detection tool: https://www.murphysec.com/?sf=qbyj
Free intelligence subscription: https://www.oscs1024.com/cm/?sf=qbyj
