CVE-2023-36884: Windows Search Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 7.5)
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Actively Exploited
Exploitation Likelihood
Detected
Publicly Disclosed
Yes
Patch Tuesday
2023-Jul
Released
2023-07-11
Last Updated
2023-10-17
EPSS Score
93.22% (percentile: 99.8%)
CISA KEV
Listed — due 2023-08-29

FAQ

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. According to the CVSS metric, successful exploitation of this vulnerability could lead to high loss of confidentiality (C:H), integrity (I:H) and availability (A:H). What does that mean for this vulnerability? An attacker can plant a malicious file evading Mark of the Web (MOTW) defenses which can result in code execution on the victim system. How could an attacker exploit the vulnerability? In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the remote code execution vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment.

Known Exploits (1)

  • Microsoft Windows Search Remote Code Execution Vulnerability — added 2023-09-28T11:53:44Z

Detection & Weaponization (2 sources)

Maturity: Detection

  • Sigma rules: Potential CVE-2023-36884 Exploitation Dropped File, Potential CVE-2023-36884 Exploitation Pattern, Potential CVE-2303-36884 URL Request Pattern Traffic, Potential CVE-2023-36884 Exploitation - File Downloads, Potential CVE-2023-36884 Exploitation - URL Marker, Potential CVE-2023-36884 Exploitation - Share Access
  • GitHub PoC: 9 repositories

Affected Products (33)

Windows

  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)

ESU

  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)

Security Updates (16)

Acknowledgments

Microsoft Office Product Group Security Team, <a href="https://twitter.com/@tlansec">Tom Lancaster</a> with <a href="https://www.volexity.com/">Volexity</a>, <a href="https://twitter.com/r00tbsd">Paul Rascagneres</a> with <a href="https://www.volexity.com/">Volexity</a>, Vlad Stolyarov, Clement Lecigne and Bahare Sabouri of Google’s Threat Analysis Group (TAG), Microsoft Threat Intelligence

Revision History

  • 2023-07-11: Information published.
  • 2023-07-12: Updated FAQ information. This is an informational change only.
  • 2023-08-08: Updated affected software to include just Windows products with links to August 2023 security updates. Adjusted information in the FAQs. The Office updates are documented in ADV230003.
  • 2023-08-09: Links on Security Updates table corrected to reflect that the updates that address this vulnerability are the August 2023 Windows updates. Microsoft recommends installing the August 2023 updates as soon as possible.
  • 2023-10-17: Added an FAQ. This is an information change only.