Bug 1217085 (CVE-2023-47039) - VUL-0: CVE-2023-47039: perl: Perl for Windows binary hijacking vulnerability
Summary: VUL-0: CVE-2023-47039: perl: Perl for Windows binary hijacking vulnerability
Status: RESOLVED UPSTREAM
Alias: CVE-2023-47039
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Michael Schröder
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/384695/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-13 13:59 UTC by SMASH SMASH
Modified: 2023-11-27 08:15 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Marcus Meissner 2023-11-13 14:00:01 UTC
currently seeing us as not affected.
Comment 3 Michael Schröder 2023-11-24 13:04:06 UTC
What do you mean? We don't ship a perl compiled for windows.
Comment 4 Marcus Meissner 2023-11-27 08:15:48 UTC
public via https://metacpan.org/release/PEVANS/perl-5.38.1/view/pod/perldelta.pod

CVE-2023-47039 - Perl for Windows binary hijacking vulnerability

This vulnerability was reported to the Intel Product Security Incident Response Team (PSIRT) by GitHub user ycdxsb https://github.com/ycdxsb/WindowsPrivilegeEscalation. PSIRT then reported it to the Perl security team.

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory.

An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

however does not affected SUSE.