Summary
Microsoft disclosed a zero-day vulnerability impacting Office and Windows on July’s Patch Tuesday. This vulnerability has an “important” severity level, and can allow attackers to perform remote code execution with the same privileges as the target. As of this writing, there is no patch available to mitigate the vulnerability, but Microsoft has provided mitigation steps. An attacker referred to by Microsoft as “Storm-0978” was observed exploiting the vulnerability by enticing victims to open malicious Office documents in email attachments.
CVE-2023-36884
Microsoft identified a phishing campaign that includes a remote code execution vulnerability exploit from a malicious Word document. The phishing campaign uses Ukrainian World Congress and NATO themes to trick targets into opening the document. Although a full list of affected Microsoft Office versions were not yet disclosed, their FAQ shows that Office365 Semi-Annual Channel Extended (specifically versions 2208 and 2202) and Microsoft 365 Apps Semi-Annual Channel Extended (specifically versions 2208 and 2202) are impacted by this vulnerability.
The malicious Word document has an embedded RTF file defined in an “altChunk” element in the “Document.xml.rels” file. The malicious RTF file has three embedded objects, two of which are used to connect to an IP address and download a malicious file via SMB and HTTP, which then uses iframe tags to continue execution.
Mitigation/Work Around
Since a patch is currently not available, Microsoft has provided an interim solution, which involves blocking Office applications from spawning child processes and adding Office applications to the registry key “FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION”. Cross-protocol navigation occurs when a web page served over one protocol attempts to access or load a file from a different protocol.
Protection
Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads.
- Netskope Threat Protection
- Win32.Exploit.CVE-2023-36884
- Netskope Advanced Threat Protection provides proactive coverage against this threat.
- Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
- Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox
