Security News > 2023 > March > PoC exploit for recently patched Microsoft Word RCE is public (CVE-2023-21716)
A PoC exploit for CVE-2023-21716, a critical RCE vulnerability in Microsoft Word that can be exploited when the user previews a specially crafted RTF document, is now publicly available.
Patches for the flaw - which affects a wide variety of MS Office and SharePoint versions, Microsoft 365 Apps for Enterprise and other products - have been released by Microsoft last month.
It is a heap corruption vulnerability in Microsoft Word's RTF parser that, if triggered, allows attackers to achieve remote code execution with the privileges of the victim.
"Microsoft Office 2010 and later use Protected View to limit damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests and thus an additional sandbox escape vulnerability would be required to gain full privileges," Drake noted in the advisory/report he sent to Microsoft.
The report also includes a proof-of-concept PoC that can be used to create a file that will trigger the vulnerability.
In the security advisory accompanying the patches, Microsoft confirmed the Preview Pane as an attack vector.
News URL
https://www.helpnetsecurity.com/2023/03/06/cve-2023-21716-poc/
Related news
- Microsoft SharePoint RCE flaw exploits in the wild – you've had 3 months to patch (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- Microsoft: Word deletes some documents instead of saving them (source)
- Microsoft fixes Word bug that deleted documents when saving (source)
- Akira and Fog ransomware now exploit critical Veeam RCE flaw (source)
- Microsoft SharePoint RCE bug exploited to breach corporate network (source)
- VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-02-14 | CVE-2023-21716 | Unspecified vulnerability in Microsoft products Microsoft Word Remote Code Execution Vulnerability | 9.8 |