webraybtl/cve-2022-24934Technical analysis and proof-of-concept exploit for CVE-2022-24934, a privilege escalation vulnerability in WPS Office's update mechanism allowing arbitrary code execution via registry manipulation.
WPS Office's updater wpsupdate.exe reads a custom update server address from the registry HKEY_CURRENT_USER, downloads a custom update program, and executes it, leading to arbitrary code execution.
WPS Office versions less than or equal to 11.2.0.10382 are vulnerable.
(WPS version numbers: the last group indicates the version; a larger last number means a newer version. 11.1 denotes the personal edition, 11.2 the enterprise edition, 11.6 and 11.8 the government-customized edition.)
Operating system: Win7 sp1.
WPS Office version: WPS 2019 v11.8.2.10229.
Analysis tools: Detect It Easy, OD, IDA, Openssl, Digital signature copying tool sigthief.py.
