Flash Notice: Patch Immediately - PoC Exploit Publicly Available for Microsoft Word RCE Vulnerability

overview

A proof-of-concept (PoC) exploit for CVE-2023-21716, a severe remote code execution (RCE) vulnerability found in Microsoft Word, is now accessible to the public. This vulnerability can be triggered when a user previews a specially crafted RTF document. 

The flaw impacts a variety of MS Office and SharePoint versions, as well as Microsoft 365 Apps for Enterprise. The vulnerability is in Microsoft Word's RTF parser and is related to heap corruption. If exploited, attackers can remotely execute code with the same level of privileges as the victim. The flaw does not need any prior authentication, meaning attackers can send a malicious RTF file via email to the victim. 

CVE-2023-21716 was discovered by security researcher, Joshua J. Drake, who stated that Microsoft Office 2010 and later use Protected View to limit the damage of malicious documents acquired from untrusted sources. The vulnerability arises when Protected View is active, hence an additional sandbox escape weakness would be necessary to gain full privileges. 

Although Microsoft has issued workarounds for CVE-2023-21716, due to the now public PoC, it is highly recommended that organizations patch immediately. Even though Microsoft has provided temporary fixes for CVE-2023-21716, organizations should prioritize patching as soon as possible due to the public availability of the PoC.  

avertium's recommendations

• Avertium recommends that organizations follow Microsoft’s patch guidance for CVE-2023-21716. 

• If you cannot patch, Microsoft has issued the following workarounds: 

• • Configure Microsoft Outlook to read all standard mail in plain text format. 
  • Use Microsoft Office File Block policy to prevent Office from opening RTF documents from unknown or untrusted sources. 

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2023-21716. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.     

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 
• Avertium offers Vulnerability Management to provide a deeper understanding and control over organizational information security risks.  If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap. 
• Avertium offers Zero Trust Architecture, like AppGate, to stop malware lateral movement. 

SUPPORTING DOCUMENTATION