Cloudanix VulnDB

CVE-2023-40481

High · 7.8

CVSS

7.8

EPSS

13.9%

Published

May 3, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in 7-Zip can let attackers take over a computer if someone opens a specially made archive file.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write during SquashFS file parsing in 7-Zip allows arbitrary code execution within the process context due to insufficient validation of user-supplied data.

Why it matters to the business

Compromise of user workstations or servers can occur when crafted archive files are opened, enabling attackers to deploy malware, steal data, or establish persistence with potential downstream effects on connected systems.

How an attack unfolds

An attacker creates a malicious SquashFS archive containing malformed data structures. The victim is tricked into opening the file with 7-Zip through email, web download, or shared storage. The parser writes beyond allocated buffer boundaries, allowing the attacker to control execution flow and run arbitrary code.

How to fix it

Update 7-Zip to the latest stable release that resolves the SquashFS parsing issue. Disable opening of untrusted archive formats where feasible and enforce application allow-listing for archive utilities.

How to confirm the fix worked

Verify installed 7-Zip version against vendor advisories, scan systems for presence of affected builds, and test file-handling behavior with synthetic test archives after patching.

Typical attack path

  1. Craft malicious SquashFS archive exploiting the parser flaw
  2. Distribute the file via phishing, malicious websites, or file shares
  3. Victim opens the archive using 7-Zip
  4. Out-of-bounds write triggers code execution in the 7-Zip process
  5. Attacker payload establishes foothold or escalates privileges

How to detect it

Review process creation logs for 7z.exe spawning unexpected child processes, inspect file access events involving .sqfs or SquashFS-named files from untrusted locations, and correlate with endpoint detection alerts on buffer overflow indicators.

What your security team should do

  • Immediately deploy updated 7-Zip versions across all endpoints
  • Educate users on risks of opening archives from unknown sources
  • Implement file-type restrictions and sandboxed archive inspection
  • Monitor for new exploit publications given the public ZDI disclosure

The record

7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 7zip 0 No fix
Debian:13 7zip 0 23.01+dfsg-1
Debian:14 7zip 0 23.01+dfsg-1
Ubuntu:22.04:LTS 7zip 0 No fix
Ubuntu:24.04:LTS 7zip 0 23.01+dfsg-3
Ubuntu:Pro:22.04:LTS 7zip 0 No fix

Related vulnerabilities