CVE-2022-29072
📋 TL;DR
This vulnerability in 7-Zip allows attackers to execute arbitrary commands with elevated privileges when a malicious .7z file is dragged to the Help>Contents area. It affects Windows users running 7-Zip versions through 21.07. The exploit leverages a heap overflow and DLL misconfiguration to achieve code execution.
💻 Affected Systems
- 7-Zip
📦 What is this software?
7 Zip by 7 Zip
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM-level privileges, allowing installation of persistent malware, data theft, and complete control of the affected system.
Likely Case
Local privilege escalation where a low-privileged user gains administrative rights on the system, potentially leading to lateral movement within a network.
If Mitigated
Limited impact with proper user training and application sandboxing, though the vulnerability could still be triggered by social engineering.
🎯 Exploit Status
Exploit requires local access and user interaction. Multiple proof-of-concept implementations are publicly available. Some reports question the privilege escalation aspect, but code execution is confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.01 and later
Vendor Advisory: https://sourceforge.net/p/sevenzip/bugs/2337/
Restart Required: No
Instructions:
1. Download latest 7-Zip version from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 22.01 or higher.
🔧 Temporary Workarounds
Disable 7-Zip Context Menu Integration
windowsPrevents 7-Zip from being triggered via file operations
reg delete "HKCU\Software\7-Zip\FM" /v "ContextMenu" /f
reg delete "HKLM\Software\7-Zip\FM" /v "ContextMenu" /f
Use Alternative Archive Software
windowsTemporarily replace 7-Zip with patched or alternative software
🧯 If You Can't Patch
- Restrict user privileges to prevent administrative access
- Implement application whitelisting to block 7zFM.exe execution
🔍 How to Verify
Check if Vulnerable:
Check 7-Zip version in Help > About. If version is 21.07 or earlier, system is vulnerable.Check Version:
"C:\Program Files\7-Zip\7zFM.exe" --versionVerify Fix Applied:
Verify 7-Zip version is 22.01 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Process creation events for 7zFM.exe with unusual parent processes
- Windows Event Logs showing 7-Zip crashes or heap corruption
Network Indicators:
- Unusual outbound connections from 7zFM.exe process
SIEM Query:
Process Creation where (Image contains '7zFM.exe' AND CommandLine contains 'Contents') OR (ParentImage contains '7zFM.exe' AND Image != '7zFM.exe')🔗 References
- http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html
- https://github.com/kagancapar/CVE-2022-29072
- https://news.ycombinator.com/item?id=31070256
- https://sourceforge.net/p/sevenzip/bugs/2337/
- https://www.youtube.com/watch?v=sT1cvbu7ZTA
- http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html
- https://github.com/kagancapar/CVE-2022-29072
- https://news.ycombinator.com/item?id=31070256
- https://sourceforge.net/p/sevenzip/bugs/2337/
- https://www.youtube.com/watch?v=sT1cvbu7ZTA
