CVE-2023-47039

What it actually does

Perl on Windows searches the current working directory for cmd.exe before system paths due to insecure path resolution order, enabling execution of attacker-placed binaries with the privileges of the invoking process.

Why it matters to the business

Administrators running Perl scripts can trigger arbitrary code execution, risking full system compromise in environments that depend on Perl for automation or tooling.

How an attack unfolds

An attacker with write access to a weakly permissioned directory such as C:\ProgramData drops a malicious cmd.exe there; when an administrator later invokes a Perl interpreter that triggers a shell command, Perl locates and executes the planted binary instead of the legitimate system cmd.exe.

How to fix it

Upgrade perl/perl5 to commit df9d952d734ef94233ed84af97ca318d7972eed0 or later; restrict write access to directories searched early in the PATH resolution; avoid running Perl under elevated contexts from untrusted working directories.

How to confirm the fix worked

Confirm the installed Perl commit or version includes df9d952d734ef94233ed84af97ca318d7972eed0; test by placing a benign executable named cmd.exe in the current directory and verifying it is no longer executed.

Typical attack path

1. Identify or create a directory with weak permissions in the Perl process's working directory search order
2. Place a malicious cmd.exe binary in that location
3. Wait for or induce an administrator to execute Perl code that invokes cmd.exe
4. Malicious binary runs with the caller's privileges to execute attacker-chosen code

How to detect it

Search process creation logs for Perl executables spawning cmd.exe from non-standard locations such as C:\ProgramData; review file creation events for cmd.exe appearing in user-writable directories.

• cmd.exe created in C:\ProgramData
• perl.exe spawning cmd.exe from non-system directory
• Process creation events where Image ends with cmd.exe and ParentImage contains perl

What your security team should do

• Apply the fixed commit df9d952d734ef94233ed84af97ca318d7972eed0 across all Perl installations
• Audit and tighten permissions on C:\ProgramData and other common working directories
• Add monitoring for cmd.exe spawned from non-system paths by Perl processes