Sumário
Microsoft disclosed a zero-day vulnerability impacting Office and Windows on July’s Patch Tuesday. This vulnerability has an “important” severity level, and can allow attackers to perform remote code execution with the same privileges as the target. As of this writing, there is no patch available to mitigate the vulnerability, but Microsoft has provided mitigation steps. An attacker referred to by Microsoft as “Storm-0978” was observed exploiting the vulnerability by enticing victims to open malicious Office documents in email attachments.
CVE-2023-36884
Microsoft identified a phishing campaign that includes a remote code execution vulnerability exploit from a malicious Word document. The phishing campaign uses Ukrainian World Congress and NATO themes to trick targets into opening the document. Although a full list of affected Microsoft Office versions were not yet disclosed, their FAQ shows that Office365 Semi-Annual Channel Extended (specifically versions 2208 and 2202) and Microsoft 365 Apps Semi-Annual Channel Extended (specifically versions 2208 and 2202) are impacted by this vulnerability.
The malicious Word document has an embedded RTF file defined in an “altChunk” element in the “Document.xml.rels” file. The malicious RTF file has three embedded objects, two of which are used to connect to an IP address and download a malicious file via SMB and HTTP, which then uses iframe tags to continue execution.
Mitigation/Work Around
Since a patch is currently not available, Microsoft has provided an interim solution, which involves blocking Office applications from spawning child processes and adding Office applications to the registry key “FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION”. Cross-protocol navigation occurs when a web page served over one protocol attempts to access or load a file from a different protocol.
Proteção
O Netskope Threat Labs está monitorando ativamente esta campanha e garantiu cobertura para todos os indicadores de ameaças e cargas conhecidas.
- Proteção Contra Ameaças Netskope
- Win32.Exploit.CVE-2023-36884
- A Netskope Advanced Protection oferece cobertura proativa contra essa ameaça.
- Gen.Malware.Detect.By.StHeur indica uma amostra que foi detectada usando análise estática
- Gen.Malware.Detect.By.Sandbox indica uma amostra que foi detectada por nosso sandbox na nuvem
