Re:7-Zip 0-day was exploited in Russia's ongoing invasion of...
by magicalhippo on Thursday February 06, 2025 @07:05AM
(#42961587)
Important context added by the one who found the vulnerability here[1].
A key factor seems to be 7-Zip doesn't just consider file extensions when determining if a file is an archive:
Now the interesting thing is 7-ZIP will not only look at the file extension BUT the files magic bytes "\x37\x7A\xBC\xAF \x27 \x1C" in the header. Recognizing the 7-Zip magic bytes, 7-Zip will then proceed to process this file as an archive, the contents of which will not receive mark-of-the-web protections due to CVE-2025-0411.
A key factor seems to be 7-Zip doesn't just consider file extensions when determining if a file is an archive:
Now the interesting thing is 7-ZIP will not only look at the file extension BUT the files magic bytes "\x37\x7A\xBC\xAF \x27 \x1C" in the header. Recognizing the 7-Zip magic bytes, 7-Zip will then proceed to process this file as an archive, the contents of which will not receive mark-of-the-web protections due to CVE-2025-0411.
[1]: https://arstechnica.com/civis/threads/7-zip-0-day-was-exploi...