CVE-2021-40399
📋 TL;DR
This vulnerability allows remote code execution through a maliciously crafted XLS file in WPS Office Spreadsheets. Attackers can exploit a use-after-free condition to execute arbitrary code on the victim's system. Users of WPS Office version 11.2.0.10351 are affected.
💻 Affected Systems
- WPS Office
- WPS Spreadsheets (ET)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's computer, enabling data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Remote code execution leading to malware installation, credential theft, or system disruption when users open malicious XLS files.
If Mitigated
Limited impact with proper email filtering, user awareness training, and application sandboxing preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.2.0.10352 or later
Vendor Advisory: https://security.wps.cn/notices/28
Restart Required: No
Instructions:
1. Open WPS Office
2. Navigate to Help > Check for Updates
3. Install available updates
4. Verify version is 11.2.0.10352 or newer
🔧 Temporary Workarounds
Disable automatic file opening
allConfigure WPS Office to not automatically open XLS files from untrusted sources
File extension filtering
allBlock .XLS files at email gateways and web proxies
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Use Microsoft Office or alternative spreadsheet software temporarily
🔍 How to Verify
Check if Vulnerable:
Check WPS Office version in Help > About WPS Office. If version is exactly 11.2.0.10351, system is vulnerable.Check Version:
wps --version (Linux) or check Help > About in GUIVerify Fix Applied:
Verify version is 11.2.0.10352 or newer in Help > About WPS Office.📡 Detection & Monitoring
Log Indicators:
- Multiple failed attempts to open XLS files
- Unexpected WPS Office crashes with memory access violations
- Process creation from WPS Office with unusual command lines
Network Indicators:
- Inbound emails with XLS attachments from unknown senders
- Downloads of XLS files from suspicious domains
SIEM Query:
process_name:"wps.exe" AND (event_id:1000 OR event_id:1001) AND file_extension:".xls"