Kingsoft WPS Office Arbitrary Code Execution Vulnerability in ksojscore.dll

A vulnerability allowing arbitrary code execution has been identified in Kingsoft WPS Office for Windows, in versions 12.1.0.18276 and prior. The issue arises from improper verification of digital signatures in the ksojscore.dll file, which enables an attacker to load malicious Windows libraries. This vulnerability was exploited by the APT-C-60 cyberespionage group, targeting users in East Asian countries.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Reproduction

The vulnerability can be reproduced by creating a malicious spreadsheet document that includes a hidden hyperlink. This hyperlink, when clicked, triggers the execution of an arbitrary library by exploiting the WPS Office custom protocol handler. The malicious library is downloaded and executed, leading to code execution on the system.

Remediation

Users are advised to update Kingsoft WPS Office for Windows to the latest version.