Microsoft Word RCE Vulnerability POC Released

THE THREAT

On March 6th, the eSentire Threat Intelligence team reviewed notable public reports and became aware of a Proof-of-Concept (PoC) exploit code release for CVE-2023-21716. The release also includes a technical write-up of the recently disclosed Microsoft Word vulnerability CVE-2023-21716 (CVSS: 9.8). The vulnerability was initially announced with the February 14th Microsoft February Patch Tuesday release. The write up was released on March 5th on Twitter and updated the POC in the report. CVE-2023-21716 is a vulnerability within Microsoft Office's wwlib, which allows attackers to achieve remote code execution via heap corruption. The vulnerability exists in the RTF parser in Microsoft Word and can be triggered by a malicious RTF document. It is notable that the preview pane for Microsoft word documents is an attack vector and will execute the payload simply by loading the preview.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) has plugins to detect this vulnerability.
• For clients with the MVS service, please review this direct link for vulnerable assets My Vulnerable MVS Assets
• eSentire security teams are tracking this vulnerability for additional details and detection opportunities.

What you should do about it

• After performing a business impact review, apply the relevant security patches.
  • Alternative mitigations are also available on the Microsoft update guide if patching is not viable in a reasonable amount of time

Additional information

Threat actors can often rapidly weaponize vulnerabilities due to the public release of technical details and functional Proof-of-Concept (PoC) exploit code. As PoC exploit code is publicly available, it is almost certain that multiple threat actors’ groups are already exploiting the vulnerability for various purposes.

Currently, there are no reported real-world attacks involving the exploitation of this vulnerability. However, threat actors are likely to migrate from Macros, ISO mounting, and OneNote delivery to corrupted “.rtf” files to gain initial access to victim organizations.

This vulnerability impacts at least the following versions of Microsoft Office:

• Microsoft Office 365 (Insider Preview - 2211 Build 15831.20122 CTR)
• Microsoft Office 2016 (Including Insider Slow - 1704 Build 8067.2032 CTR)
• Microsoft Office 2013
• Microsoft Office 2010
• Microsoft Office 2007

Older versions may also be impacted but were not tested. Furthermore, the technical details of this vulnerability have evolved over the years.

Will Dormann identified on March 7th that even after the patch is applied, the malicious payloads still crash a fully patched Microsoft Word on Mac OS; however, remote code execution appears to be no longer possible.

It is recommended to enable Protected View on Microsoft Office 2010 and later versions to limit the damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests; thus, an additional sandbox escape vulnerability would be required to gain full privileges.

Removing the file association for the RTF extension is ineffective because using a DOC extension will still reach the vulnerable code.

References:

[1] https://qoop.org/publications/cve-2023-21716-rtf-fonttbl.md
[2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
[3] https://www.heise.de/news/Kritische-Word-Luecke-Proof-of-Concept-Code-veroeffentlicht-7537267.html
[4] Nessus Plugin ID 171554