kagancapar/cve-2022-29072

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

cve-2022-29072's Issues

Bir paket yükelemesinde bu rastladım

Merhaba Kağan Bey

Bu sorunu kaspersky öneresinde buldum ve github linki ile sizin çalışmanızı gördüm bunun için size teşekkür ederim . Ben büyük bir .exe çalıştırdım ve kuruşum dosyalarında bahsedilen dosya bulunuyordu şayet ben 7zip kullanmıyorum Winrar kullanıyordum
ve akabinde direk sildim şuan sanırım kurtuldum sizlerede danışmak istedim
Çalışmalarınız için tebrik ederim iyi çalışmalar

Missing files

Hey bro,
I can't reproduce in my environment. Some files appear to be missing. Would you kindly upload the privesc part?

I can't reproduce

I can't reproduce the problem described in your video. what is the "privese.exe"? Is this what caused it?

无法复现

按照视频中的程序跑了一下，不存在这个提权行为，权限还是原来的普通用户权限 测试来源win10 21h2 7z版本目前最新的测试版，难道说有通过其他的方式来利用或者说是的方式有误吗 视频中的文件可否发一下

CVE has changed to disputed

Not sure how much this vulnerability is real but there are some things going on:

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29072

See also: https://sourceforge.net/p/sevenzip/discussion/45797/thread/65ce9ab4cb/

How to use this exploit if i wont have GUI

Like the title, the POC said you must drag the malicious html file into content area. Without GUI, the exploit is not happend ?

Privesc on private message

Please Sir,

i want learn more about this attack can u send privesc code on private?

including or excluding 21.07?

the wording "7-Zip through 21.07" is not clear
I think it'll be informative to make it more understandable if there is a safe version

Please sir show the code!

Please sir show the code!

Is this really a 7-zip issue, or is it a Microsoft issue?

The mitigation steps don't quite make sense to me, because if someone really wanted to exploit this, they would just have to download the affected 7zip executable, the affected chm file, and the specifically crafted 7z file to any system, and voila. So that means there really is no mitigation to this other than, maybe, application blacklisting?

Am I missing something?

Expanding on the above, that means it would be far easier for someone to create a malicious dll file that explots the inherent vulnerability in Microsoft's CHM system, and then you have an exploit that doesn't depend on 7zip at all. This means that the vulnerability isn't really with 7zip at all, but with Microsoft, and there is no type of mitigation until Microsoft patches it.

Linkedin private message

Linkedin private message, see hope to reply to exchange

Update

there is 7-zip 22.00