Mitigating CVE-2022-29072 (7-zip) with MEM

As part of our Cloud Control Managed Endpoint services, we ensure our customers are working in a secure and optimized environment. In order to do that, we are continuously monitoring the threat landscape looking for vulnerabilities which could impact our customers.

Identifying vulnerable devices

To identify which devices are vulnerable, Microsoft Defender’s Threat & Vulnerability Management can be used. The vulnerability exists in all versions of 7-zip, including the latest version 21.07.

As there is no patch available, Microsoft Defender doesn’t report on this vulnerability at the moment. One way to identify affected devices is by going into the Security portal and selecting Vulnerability Management > Software inventory and selecting 7-zip in the software list. This can also be accessed through the following URL.

Remediating the vulnerability

At the time of writing, no patch is available to mitigate this issue which means it is exploitable by default. This issue can be mitigated by removing the ‘7-zip.chm’ file which ensures the vulnerability is no longer exploitable.

This file is responsible for some of the ‘Help’ aspects of the 7-zip application and will not prevent 7-zip core capabilities, e.g.: unzipping archives. The user impact is limited to the fact that users will not be able to open the Help > Contents blade (But let’s be honest, who has opened this before?).

This mitigation can be mitigated by using a proactive remediation which can be deployed through Microsoft Endpoint Manager. This can be implemented by navigating to the Endpoint portal and selecting Reports > Endpoint Analytics > Proactive remediations.

As detection script, use the following code:

For the remediation, the following Powershell code will remove the vulnerable file:

Note: This remediation assumes you have installed 7-zip in the default installation path.

Want to work together?

If you are a ‘Cloud Control Managed Endpoint’ customer, we have already identified the vulnerable devices in your environment and are reaching out for the remediation steps.

Do you want us to help you mitigate vulnerabilities and stay ahead of current attacks, take a look at our Managed Services and get in touch.