Akamai’s Perspective on August’s Patch Tuesday 2023

Vulnerability reported by an Akamai researcher

CVE-2023-35384 — Windows HTML platforms (CVSS 5.4)

Despite the low severity assigned to this vulnerability, it has quite an interesting background and consequences. Ben Barnea found it during his analysis of the May Patch Tuesday, and it was fixed this month.

Initially, Microsoft patched CVE-2023-2339‏7 — a critical elevation of privilege (EoP) vulnerability in Outlook that had been exploited in the wild. This vulnerability allowed an attacker to send the victim an email, trigger an SMB connection to its own attacker-controlled server, and, as a result, intercept (and possibly crack or relay) NTLM credentials. This was a zero-click vulnerability that could be exploited by an unauthenticated attacker from anywhere on the internet.

The fix to CVE-2023-2339‏7 added a check to classify a path as local, intranet, internet, etc. This check could be bypassed by supplying a specially crafted path, as we explained and demonstrated in a previous blog post.

This month’s CVE-2023-35384 is yet another bypass of Microsoft’s fix. Confused? Let’s put things in order:

We are planning to share the details of CVE-2023-35384 and demonstrate its exploitation in a surprising way, so make sure to keep an eye out for the publication.

Vulnerability exploited in the wild

CVE-2023-38180 — .NET Core and Visual Studio (CVSS 7.5)

This is a DoS vulnerability, but there are no notes, FAQ, or acknowledgments released with this CVE. Therefore, it is nearly impossible to speculate on its root cause. However, since the attack vector is network, we have some clues. Disclaimer: The following paragraph is purely speculative.

According to results from our tests on locally installed instances of Visual Studio, this CVE doesn’t appear to be listening to incoming connections (though we did see outbound connections from its process). As such, it is more likely that the attack vector isn’t achieved by the attackers reaching out directly to the process over the network, but rather by sending some maliciously crafted file to the victim, which then crashes their instance of Visual Studio and the .NET Core.

Microsoft Message Queuing

There were 11 vulnerabilities in the Microsoft Message Queuing (MSMQ) service patched this month. Three critical 9.8 remote code execution (RCE) vulnerabilities, six DoS vulnerabilities, and two information disclosure vulnerabilities. 

The MSMQ service is an optional feature in Windows that is used to deliver messages between different applications. Despite being optional, it is used behind the scenes by many enterprise applications for Windows, such as Microsoft Exchange Server. In our observations, we found the service installed in nearly 69% of environments, usually on more than one machine.

Since the MSMQ service is accessible over port 1801, but shouldn’t be accessed by very many clients (since it’s mostly used by the enterprise application itself), we recommend restricting arbitrary network access to that port and service. Try to segment it using allowlist policies, enabling access only to the machines that actually need it. For help with segmentation, you can refer to our blog post (Micro)Segmentation from a Practical Perspective (and specifically to the application ringfencing and microsegmentation sections).

Microsoft Exchange Server

This month, there were six CVEs in Microsoft Exchange Server — four of them allow remote code execution on the remote server, and the other two are EoP or spoofing vulnerabilities. In our observations, we’ve seen that approximately 28% of environments had on-premises Microsoft Exchange Servers.

The EoP CVE, CVE-2023-21709, is actually the CVE with the highest CVSS score (9.8) despite being categorized as “Important,” not “Critical,” severity. According to Microsoft, the vulnerability could allow attackers to brute force an Exchange user’s password and log in as that user. The Important severity is due to the fact that brute force attacks shouldn’t work against users with complex passwords. 

For this CVE, merely patching is not enough. Microsoft provides an additional script, CVE-2023-21709.ps1, which administrators need to run after installing the patch. Alternatively, the following command will work:

Microsoft also mentions that running the script (or the command above) can address the vulnerability in lieu of patching, but they (and we) strongly recommend patching as soon as possible.

Previously covered services

Many CVEs in this month’s Patch Tuesday are for systems that we’ve already covered in the past. If you’re interested in our analysis of, or general recommendations for, those services, we encourage you to look at our previous perspectives on Patch Tuesday blog posts.