WPS Office Zero Day Vulnerability on 7 Aug 2023 - workaround on network level but have side effect

Solution:

Block *.wps.cn on firewall, since the attacker use the vulnerability to redirect the WPS to xxxwps.cn, then trigger the attack by exploit the vulnerability.

 

Drawback:

Cannot use some wps cloud service, function and features (e.g. 云文档等功能)

 

WPS Office Zero Day Vulnerability on 7 Aug 2023 - workaround on network level but have side effect

Massive deploy WPS 2019 Zero day vulnerability on 7 Aug 2023 workaround

1. 将ReplacePreferences_en.bat脚本与"Preferences"文件放到同一文件夹内；

2. 执行ReplacePreferences_en.bat脚本；

3. 如果提示"Replace Success"则替换成功

 

*The file "Preferences" can be copy from one of the machine which is manually change the configuration successfully, and the file under "%appdata%\kingsoft\wps\addons\data\win-i386\promebrowser"

 

If you did not find the file and/or folder "wps" under "%appdata%\kingsoft", that mean you did not click the option center (Settings) before.

 

 

 

"ReplacePreferences_en.bat"

 

@echo off

REM 执行前需确保此bat和替换的Preferences文件在同一文件夹内

REM dst为目标替换路径，云桌面用户如果%appdata%路径在网络路径中，需要自己修改为对应dst, 也需要对应修改wpsPath

set dst=%appdata%\kingsoft\wps\addons\data\win-i386\promebrowser

set wpsPath=%appdata%\kingsoft\wps

 

if not exist %dst% (

              goto createPath

              ) else (

                           goto replaceFile

              )

goto end

 

:createPath

              if not exist %dst% (

                                         mkdir %dst%

                           )

              goto replaceFile

              )

 

:replaceFile

if exist .\Preferences (

              taskkill /f /im wpscloudsvr.exe

              taskkill /f /im wps.exe

              taskkill /f /im wpp.exe

              taskkill /f /im et.exe

              taskkill /f /im wpspdf.exe

              taskkill /f /im wpsupdate.exe

              taskkill /f /im updateself.exe

              taskkill /f /im ktpcntr.exe

              taskkill /f /im wpsoffice.exe

              if exist %dst%\Preferences (

                           del %dst%\Preferences

              )

              copy .\Preferences %dst%

              goto replaceSuccess

)

goto replaceFileNotExist

 

:replaceFileNotExist

echo Preferences File Not Exist!

goto end

 

:replaceSuccess

echo Replace Success

goto end

 

:end

pause

 

Massive deploy WPS 2019 Zero day vulnerability on 7 Aug 2023 workaround

WPS Office Zero Day Vulnerability on 7 Aug 2023

Affected Version:

WPS Office 2023 Personal Edition < 11.1.0.15120

WPS Office 2019 Corporate Edition < 11.8.2.12085

 

Solution:

1. Upgrade to latest versions
2. Apply workaround, under option center, website browsing settings:

 

 

CHS edition Personal: 目前官网最新版本为15324可以进行下载升级

CHS edition Corporate: 目前官网最新版本为12085可以进行下载升级

ENG and CHT are still under development

 

Reference:

https://security.wps.cn/notices/35

 

WPS Office Zero Day Vulnerability on 7 Aug 2023