LG Simple Editor deleteFolder 目录遍历任意文件删除漏洞

攻击者可以利用此漏洞删除系统上的任意文件，从而导致严重的数据丢失和系统不稳定。由于无需身份验证即可利用此漏洞，因此攻击面非常广。攻击者可能删除关键系统文件，导致服务中断或完全瘫痪。此外，攻击者可能删除敏感数据，导致数据泄露。该漏洞的潜在影响类似于其他目录遍历漏洞，可能导致未经授权的访问和修改。

Organizations utilizing LG Simple Editor, particularly those with older versions (3.21.0 and prior), are at risk. Environments with limited network segmentation or those lacking robust file permission controls are especially vulnerable. Shared hosting environments where multiple users share the same server instance could also be affected, as a compromised user could potentially exploit this vulnerability to impact other users.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*LG Simple Editor*'} | Stop-ScheduledTask

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*LG Simple Editor*'} | Stop-Process -Force

• windows / supply-chain: Check Autoruns for entries related to LG Simple Editor that might indicate persistence mechanisms. • windows / supply-chain: Monitor Windows Defender for alerts related to suspicious file deletion activity in the LG Simple Editor installation directory.

1. 2024-05-03Disclosure

   disclosure

1. 已保留2023-08-14
2. 发布日期2024-05-03
3. 修改日期2024-09-18
4. EPSS 更新日期2026-04-02

由于 LG Simple Editor 3.21.0 存在漏洞，建议立即升级到已修复的版本。如果无法立即升级，可以考虑以下缓解措施：限制对 LG Simple Editor 的访问，仅允许授权用户访问。实施严格的文件访问控制，防止未经授权的删除操作。监控 LG Simple Editor 的日志文件，查找可疑活动。如果可能，配置 Web 应用防火墙 (WAF) 以阻止目录遍历攻击。使用文件完整性监控工具来检测未经授权的文件更改。