The South Korea-aligned APT-C-60 group exploited a remote code execution vulnerability (CVE-2024-7262) in WPS Office to attack East Asian countries
Researchers of ESET, a global European leader in the cybersecurity market, have discovered a remote code execution vulnerability in WPS Office for Windows (CVE-2024-7262), exploited by APT-C-60, a South Korea-aligned cyberespionage group, to target East Asian countries. While investigating the causes, ESET discovered another way to exploit the faulty code (CVE-2024-7263). After a coordinated disclosure process, both vulnerabilities were patched. The final payload in the APT-C-60 attack is a custom backdoor with cyber espionage capabilities that ESET Research has internally named SpyGlace.
"While investigating APT-C-60's activities, we found an unusual spreadsheet document that referenced one of the group's numerous downloader components. The WPS Office software has over 500 million active users worldwide, making it a good means of reaching a substantial number of people, particularly in the East Asia region," says Romain Dumont, the ESET researcher who analyzed the vulnerabilities. During the vulnerability disclosure process coordinated between ESET and the vendor, DBAPPSecurity independently published a weaponized vulnerability analysis and confirmed that APT-C-60 exploited the vulnerability to distribute malware to users in China.
The malicious document appears as an MHTML export of the commonly used XLS format but contains a specially crafted, hidden hyperlink designed to trigger the execution of an unauthorized library if clicked when using the WPS Spreadsheet application. The unconventional MHTML file format allows a file to be downloaded as soon as the document is opened; therefore, adopting this technique while exploiting the vulnerability allows remote code execution.
"To exploit this vulnerability, an attacker would have to store a malicious library somewhere accessible by the target computer, either on the system or on a remote share, and know the path to the file in advance. The exploit developers who exploited this vulnerability knew a few tricks that helped them achieve their goal," explains Dumont. “When you open the spreadsheet document with the WPS Spreadsheet application, the remote library is automatically downloaded and stored on disk,” he adds.
Since this is a one-click vulnerability, the exploit's developers embedded an image of the spreadsheet's rows and columns to convince the user that the document is a normal spreadsheet. The malicious hyperlink was linked to the image in such a way that clicking on a cell there would activate the exploit.
“Regardless of whether the group developed or purchased the exploit for CVE-2024-7262, it certainly required research into the internals of the application, but also knowledge of the behavior of the Windows loading process,” concludes Dumont.
After analyzing the patch quietly released by Kingsoft, Dumont noticed that the flaw had not been properly fixed and discovered another way to exploit it due to improper input validation. ESET Research reported both vulnerabilities to Kingsoft, which recognized and patched them. Two high severity CVE entries have been created: CVE-2024-7262 and CVE-2024-7263.
The discovery highlights the importance of a careful patch testing process and the need to ensure that the underlying issue has been fully addressed. ESET strongly recommends that users of WPS Office for Windows update their software to the latest version.
For more technical information on WPS Office vulnerabilities and exploits, see the blog “Analysis of two arbitrary code execution vulnerabilities affecting WPS Office” on WeLiveSecurity.com. Follow ESET Research on Twitter (now known as X) For the latest news from ESET Research.
