Flash Notice: Critical Vulnerability Found in Windows Queuing Middleware Service

overview

A critical vulnerability (CVE-2023-21554) was disclosed by Check Point researchers in the Windows Message Queuing (MSMQ) middleware service this week. According to the researchers from Check Point, CVE-2023-21554 allows unauthenticated attackers to remotely execute arbitrary code by reaching the TCP port 1801 on unpatched Windows servers via malicious MSMQ packets. The attack is low-complexity and does not require user interaction.

Although available on all Windows operating systems, MSMQ is an optional Windows component and not installed by default. MSMQ provides apps with network communication with "guaranteed message delivery" feature. Users can enable the service through PowerShell or through the Control Panel.

The MSMQ service is classified as a "middleware" service and is relied upon by several popular software applications. Upon installing these applications, the MSMQ service is automatically enabled on Windows, which can happen without the user knowing. Currently, more than “360,000 IPs have the 1801/tcp open to the Internet and are running the MSMQ service.” It is important to note that once MSMQ is activated on a server, it becomes susceptible to exploitation by attackers through any MSMQ vulnerability, which may result in the takeover of the server.

Microsoft patched CVE-2023-21554 for Patch Tuesday and Avertium recommends that all Windows administrators check servers to see if the MSMQ service is installed. Instructions for patching and for checking servers can be found below.

avertium's recommendations

• To determine whether the 'Message Queuing' service is active and TCP port 1801 is open on your computer, you can conduct a quick investigation. If it is installed, double check to determine if it is necessary. This will close unnecessary attack surfaces.
• Patch guidance for CVE-2023-21554 can be found in Microsoft’s advisory.
  • If your organization cannot install the patch immediately, Check Point recommends blocking the inbound connection for 1801/tcp from untrusted sources with Firewall rules as a workaround.

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2023-21554. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts.
• Avertium offers Vulnerability Management to provide a deeper understanding and control over organizational information security risks. If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap.
• Avertium offers Zero Trust Network as a Service (ZTNaaS) for any organization that wants to control their attack surface. The zero-trust security model delivers exactly what the name promises: it is an IT security concept that specifies no access is allowed until the successful completion of authentication and authorization processes. 

SUPPORTING DOCUMENTATION