Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
MITRE ATT&CK Framework, Cybersecurity Assessment, SOC Calculator & more
On March 6th, the eSentire Threat Intelligence team reviewed notable public reports and became aware of a Proof-of-Concept (PoC) exploit code release for CVE-2023-21716. The release also includes a technical write-up of the recently disclosed Microsoft Word vulnerability CVE-2023-21716 (CVSS: 9.8). The vulnerability was initially announced with the February 14th Microsoft February Patch Tuesday release. The write up was released on March 5th on Twitter and updated the POC in the report. CVE-2023-21716 is a vulnerability within Microsoft Office's wwlib, which allows attackers to achieve remote code execution via heap corruption. The vulnerability exists in the RTF parser in Microsoft Word and can be triggered by a malicious RTF document. It is notable that the preview pane for Microsoft word documents is an attack vector and will execute the payload simply by loading the preview.
Additional information
Threat actors can often rapidly weaponize vulnerabilities due to the public release of technical details and functional Proof-of-Concept (PoC) exploit code. As PoC exploit code is publicly available, it is almost certain that multiple threat actors’ groups are already exploiting the vulnerability for various purposes.
Currently, there are no reported real-world attacks involving the exploitation of this vulnerability. However, threat actors are likely to migrate from Macros, ISO mounting, and OneNote delivery to corrupted “.rtf” files to gain initial access to victim organizations.
This vulnerability impacts at least the following versions of Microsoft Office:
Older versions may also be impacted but were not tested. Furthermore, the technical details of this vulnerability have evolved over the years.
Will Dormann identified on March 7th that even after the patch is applied, the malicious payloads still crash a fully patched Microsoft Word on Mac OS; however, remote code execution appears to be no longer possible.
It is recommended to enable Protected View on Microsoft Office 2010 and later versions to limit the damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests; thus, an additional sandbox escape vulnerability would be required to gain full privileges.
Removing the file association for the RTF extension is ineffective because using a DOC extension will still reach the vulnerable code.
[1] https://qoop.org/publications/cve-2023-21716-rtf-fonttbl.md
[2] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
[3] https://www.heise.de/news/Kritische-Word-Luecke-Proof-of-Concept-Code-veroeffentlicht-7537267.html
[4] Nessus Plugin ID 171554