CVE-2023-21716: A new Office Exploit

 In Feb-2023, Microsoft (MS) patched a vulnerability in Microsoft Word which, if successfully exploited, could allow an attacker to execute remote code without authentication on victims’ machines. This vulnerability has been assigned CVE-2023–21716 and has a CVSS score of 9.8, making it a critical issue. This vulnerability impacted MS word and the Outlook Preview Pane as well. Microsoft along with the patch released a work around for the vulnerability but did not release details about the vulnerability.

While we were analysing to identify what was patched, on 06-March, the researcher who reported the bug released a PoC on Twitter. In this blog, we will be taking a look at some internals of CVE-2023–21716. So far there is no evidence to suggest exploitation of this vulnerability in the wild.

Rich Text Format (RTF) is a document file format published by Microsoft. It uses control words to define various sections and properties of the document. CVE-2023–21716 exists in the way MS Word parses the RTF files. The RTF file structure has \fonttbl control word, which defines a group of all the fonts that can be referred to in the document. These fonts are referred to using the assigned font number \f<num>.

In Figure 1, the part highlighted in red shows \fonttbl control word defined and the part highlighted in blue shows the fonts being referred to in the text, in a regular RTF file.

By providing a long list of fonts to this control word, it is possible to crash MS Word when this specially crafted document is open. We were able to generate a RTF document using the published PoC. As expected, as soon as it was open using MS Word, it crashed.

After configuring WinDbg to catch the crash, postmortem debugging, we were able to analyse the crash. Figure 2 shows the stack trace at the time of crash.

Using the WinDbg crash analysis extension, we observed that this crash is caused due to a heap overflow in the call made to MsoFreePpv() function in mso.dll by wwlib.dll. wwlib.dll is responsible for parsing RTF documents in MS Word.

Figure 3 shows the Heap Corruption message displayed by the WinDbg. Figure 4 points towards the location of the crash.

The Patch

As per the details available online by the researcher who reported the issue to MS; the issue was reported in Nov-2022, however, was patched only in Feb-2023. To patch the reported issues, MS has added a function call to SafeIntOnOverflow() from SafeInt class, in wwlib!FSearchFtcmap() function. SafeInt is a class defined to gracefully handle overflows. Figure 5 shows the patch diff of FSearchFtcmap() function in the two versions of the wwlib.dll.

This new function prevents MS Word from crashing. When the postmortem debugger is enabled, it shows that the overflow is caught safely. There were reports that on some systems the patch was not working properly, but we could not verify those claims.

In the last couple of years, with Microsoft restricting document macros from executing to prevent cyber attacks, threat actors have resorted to exploiting vulnerabilities in MS Office — Word, Excel and RTF files. With the publicly available PoC, we believe threat actors might start exploiting this RTF vulnerability to gain a foothold in the target network.

We recommend –

  1. All users should keep their OS and applications such as MS Office up-to-date
  2. Use MS Office protected mode to access documents from untrusted sources
  3. MS File Block policy can be used to block RTF files from unknown and untrusted sources

Further Readings

  1. Read more about Microsoft Workaround and security patch from here.
  2. Get some insight into RTF file structure from here.
  3. Details published by a security researcher who reported the issue is here.

For more info : https://bit.ly/3JJPABF

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more