CVE-2023-0104
📋 TL;DR
This vulnerability in Weintek EasyBuilder Pro allows attackers to execute arbitrary code or access sensitive data by tricking users into opening malicious project files. The ZipSlip attack occurs during decompilation, enabling file overwrites outside intended directories. Users of vulnerable versions are at risk.
💻 Affected Systems
- Weintek EasyBuilder Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to install malware, steal credentials, or pivot to other systems.
Likely Case
Local file system compromise leading to data theft or privilege escalation on the affected machine.
If Mitigated
Limited impact with proper file integrity monitoring and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires social engineering to deliver malicious project file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6.08.02
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01
Restart Required: Yes
Instructions:
1. Download v6.08.02 from official Weintek website. 2. Backup existing projects. 3. Run installer with administrative privileges. 4. Restart system after installation.
🔧 Temporary Workarounds
Restrict Project File Sources
windowsOnly open project files from trusted sources and implement file validation.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables.
- Use least privilege accounts and restrict file system write permissions.
🔍 How to Verify
Check if Vulnerable:
Check EasyBuilder Pro version in Help > About menu.Check Version:
Not applicable - check via application GUI.Verify Fix Applied:
Confirm version is v6.08.02 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside project directories
- Multiple failed file access attempts
Network Indicators:
- Unexpected outbound connections after project file opening
SIEM Query:
EventID=4663 AND ObjectName LIKE '%..%' AND ProcessName='EasyBuilderPro.exe'