Bandizip Fails to Propagate Mark-of-the-Web for PowerShell Files

Executive Summary

Bandisoft Bandizip before version 7.47 fails to propagate the Mark-of-the-Web attribute to extracted PowerShell script files (.ps1 and .psm1). This allows unsigned scripts to bypass zone-based execution protections in Windows. Attackers can embed malicious scripts in downloaded archives that appear safe but execute under the RemoteSigned policy when opened by the user.

Useful 0 Not Useful 0

Detection Guidance

Check if Bandizip version is below 7.47 by running 'bandizip -v' or checking installed programs. Monitor extracted .ps1 and .psm1 files for missing Mark-of-the-Web attributes using PowerShell commands like 'Get-Item -Path .\extracted.ps1 | Select-Object -Property Zone.Identifier'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass security measures and execute malicious PowerShell scripts on your system. If you download and extract archives using Bandizip before 7.47, unsigned scripts could run without triggering Windows security warnings. This could lead to unauthorized code execution, data theft, or further compromise of your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing attackers to execute unsigned PowerShell scripts via Bandizip archives. This bypasses zone-based protections, potentially enabling unauthorized data access or modification, which violates integrity and confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Bandizip to version 7.47 or later immediately. Disable PowerShell script execution policies temporarily if not required. Scan extracted archives for unsigned .ps1 and .psm1 files before execution.

Useful 0 Not Useful 0