Unpatched Microsoft 0-Day: How to Mitigate CVE-2023-36884 with PowerShell

Microsoft’s July 2023 Patch Tuesday updates highlighted several vulnerabilities under active exploitation, including one (or more?) that remains unpatched. Here’s what you need to know about CVE-2023-36884, a zero-day vulnerability that attackers are exploiting to gain remote code execution via “specially-crafted” Microsoft Office documents.

What is CVE-2023-36884?

Short answer: Microsoft characterizes CVE-2023-36884 as an Office and Windows HTML remote code execution vulnerability with a base CVSS of 8.3.

More substantial answer: To come?

For now, the company’s advisory implies that Microsoft is still actively investigating, and doesn’t really provide much beyond a perfunctory description. It states that successful exploitation of the vulnerability can enable an attacker to perform remote code execution in the context of the victim, and simply requires tricking the victim into opening a specially crafted Microsoft Office document.

The advisory also curiously opens by stating, “Microsoft is investigating reports of a series of remote code execution vulnerabilities” (emphasis mine), causing vulnerability expert Will Dormann to theorize, “CVE-2023-36884 is merely a placeholder for an update to address multiple vulnerabilities by way of a single CVE, which may get released at some unknown point in the future.”

While the advisory, itself, lacks specifics, it does link to a blog post that sheds more light on how Microsoft discovered it.

Espionage and ransomware — active exploitation of CVE-2023-36884

In June, Microsoft identified a phishing campaign launched by a threat actor Microsoft tracks as Storm-0978. The campaign targeted defense and government entities in North America and Europe, with lures related to the Ukrainian World Congress. Emails delivered as part of the campaign contained links to Word documents that abused CVE-2023-36884 in order to install backdoors.

While those targets and post-compromise activities suggest espionage motives, Microsoft notes that, as this campaign was running, it also identified Storm-0978 conducting separate ransomware attacks on unrelated targets using the same initial payloads.

According to Microsoft, the threat actor’s ransomware activity has been, “largely opportunistic in nature and entirely separate from espionage-focused targets.”

UPDATE: An even more in-depth technical breakdown of this campaign is available from BlackBerry.

Is there a patch available for CVE-2023-36884?

At the moment, no.

Microsoft suggests it is still actively investigating this vulnerability, and upon completion the company, “will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.”

Mitigations for CVE-2023-36884

According to Microsoft, there are currently three ways for companies to protect themselves now:

1. Customers who use Microsoft Defender for Office are protected from attachments that attempt to exploit this vulnerability.
2. In current attack chains, the use of the Block all Office applications from creating child processes Attack Surface Reduction Rule will prevent the vulnerability from being exploited.
3. Organizations who cannot take advantage of these protections can add the following application names to this registry key as values of type REG_DWORD with data 1.:
   ComputerHKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION

• • Excel.exe
  • Graph.exe
  • MSAccess.exe
  • MSPub.exe
  • PowerPoint.exe
  • Visio.exe
  • WinProj.exe
  • WinWord.exe
  • Wordpad.exe

Note: Microsoft provides a disclaimer that while these registry settings can mitigate exploitation,  they could also affect regular functionality for certain use cases related to these applications. Therefore, it’s important to test before deploying changes widely.

How to mitigate CVE-2023-36884 using PowerShell

For those in the third camp considering making the registry changes, our Software Product Engineer Kyle Bohlander has created the following script that will automate that process. Utilizing this script with Ninja (or your RMM of choice) will enable you to deploy the mitigation remotely and at scale.

Note: This script isn’t limited to just NinjaOne users. It can be used by anyone. As Microsoft advises, however, this fix should be deployed on test machines prior to wider deployment. Per usual, if you choose to run it it’s at your own risk.

Device requirements: Works on Windows 7 and Windows Server 2008 systems and up.

If you need to revert: The registry key settings can be undone with the -Undo parameter, or applied to specific Office products using the -OfficeProducts parameter.

 

Script author: Kyle Bohlander, Software Product Engineer at NinjaOne

 

 

Download the script file here.

<#
.SYNOPSIS
    This script will set the registry keys required to remediate CVE-2023-36884. Please note that these keys may effect regular functionality of Microsoft Office Products. 
    These changes can be undone with the -Undo parameter or applied only to specific office products using the -OfficeProducts parameter.
.DESCRIPTION
    This script will set the registry keys required to remediate CVE-2023-36884. Please note that these keys may effect regular functionality of Microsoft Office Products. 
    These changes can be undone with the -Undo parameter or applied only to specific office products using the -OfficeProducts parameter.
.EXAMPLE
    (No Parameters)
    
    Visio was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONVisio.exe to 1
    Success!
    Word was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinWord.exe to 1
    Success!
    Wordpad was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWordpad.exe to 1
    Success!
    Project was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinProj.exe to 1
    Success!
    PowerPoint was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONPowerPoint.exe to 1
    Success!
    Excel was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONExcel.exe to 1
    Success!
    Publisher was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONMsPub.exe to 1
    Success!
    Graph was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONGraph.exe to 1
    Success!
    Access was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONMSAccess.exe to 1
    Success!
​
PARAMETER: -Undo
    Remove's the registry keys used for this fix (if they're set at all).
.EXAMPLE
    -Undo
    
    Visio was selected for remediation.
    Succesfully removed registry key!
    Word was selected for remediation.
    Succesfully removed registry key!
    Wordpad was selected for remediation.
    Succesfully removed registry key!
    Project was selected for remediation.
    Succesfully removed registry key!
    PowerPoint was selected for remediation.
    Succesfully removed registry key!
    Excel was selected for remediation.
    Succesfully removed registry key!
    Publisher was selected for remediation.
    Succesfully removed registry key!
    Graph was selected for remediation.
    Succesfully removed registry key!
    Access was selected for remediation.
    Succesfully removed registry key!
​
PARAMETER: -OfficeProducts "Excel,Word"
    Set's the registry key for only those products. Can be given an individual product or a comma seperated list. Can also be used in combination with the -Undo parameter Ex. "Publisher" or "Word,Excel,Access"
.EXAMPLE
    -OfficeProducts "Excel,Word"
    
    Word was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONWinWord.exe to 1
    Success!
    Excel was selected for remediation.
    Set Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATIONExcel.exe to 1
    Success!
​
.OUTPUTS
    None
.NOTES
    General notes
#>
[CmdletBinding()]
param (
    [Parameter()]
    [String]$OfficeProducts = "All",
    [Parameter()]
    [Switch]$Undo
)
​
begin {
​
    # Test's if the script is running in an elevated fashion (required for HKLM edits)
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    }
​
    # This is just to make setting regkey's easier
    function Set-RegKey {
        param (
            $Path,
            $Name,
            $Value,
            [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
            $PropertyType = "DWord"
        )
        if (-not $(Test-Path -Path $Path)) {
            # Check if path does not exist and create the path
            New-Item -Path $Path -Force | Out-Null
        }
        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {
            # Update property and print out what it was changed from and changed to
            $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name
            try {
                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            }
            Write-Host "$Path$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)"
        }
        else {
            # Create property with value
            try {
                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null
            }
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            }
            Write-Host "Set $Path$Name to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)"
        }
    }
​
    # All the microsoft office products with their corresponding dword value
    $RemediationValues = @{ "Excel" = "Excel.exe"; "Graph" = "Graph.exe"; "Access" = "MSAccess.exe"; "Publisher" = "MsPub.exe"; "PowerPoint" = "PowerPnt.exe"; "OldPowerPoint" = "PowerPoint.exe" ; "Visio" = "Visio.exe"; "Project" = "WinProj.exe"; "Word" = "WinWord.exe"; "Wordpad" = "Wordpad.exe" }
}
process {
​
    # Error out when not elevated
    if (-not (Test-IsElevated)) {
        Write-Error -Message "Access Denied. Please run with Administrator privileges."
        exit 1
    }
​
    # If they have a smaller selection we'll want to filter our remediation list
    if ($OfficeProducts -notlike "All") {
        $OfficeProducts = $OfficeProducts.split(',') | ForEach-Object { $_.Trim() }
        $RemediationTargets = $RemediationValues.GetEnumerator() | ForEach-Object { $_ | Where-Object { $OfficeProducts -match $_.Key } }
    }
    else {
        $RemediationTargets = $RemediationValues.GetEnumerator()
    }
​
    # Path to all the registry keys
    $Path = "Registry::HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftInternet ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION"
​
    # We'll want to display an error if we don't have anything to do
    if ($RemediationTargets) { 
​
        # For Each product we're targeting we'll set the regkey. The Set-RegKey function already checks if it was succesful and will display an error and exit if it fails
        $RemediationTargets | ForEach-Object { 
            Write-Host "$($_.Name) was selected for remediation."
            if (-not $Undo) {
                Set-RegKey -Path $Path -Name $_.Value -Value 1
                Write-Host "Success!"
            }
            else {
                # If you only applied it to certain products this will error so instead we'll hide the errors and check afterwards if the registry key is there.
                Remove-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue | Out-Null
                if (Get-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue) {
                    Write-Error "[Error] Unable to undo registry key $($_.Value)!"
                    exit 1
                }
                else {
                    Write-Host "Succesfully removed registry key!"
                }
            }
        }
​
        Write-Warning "A reboot may be required."
        exit 0
    }
    else {
        Write-Host $RemediationTargets
        Write-Warning "No products were selected! The valid value's for -OfficeProducts is listed below you can also use a comma seperated list or simply put 'All'."
        $RemediationValues | Sort-Object Name | Format-Table | Out-String | Write-Host
        Write-Error "ERROR: Nothing to do!"
        exit 1
    }
}