July 11, 2023 CISA KEV Breakdown | Microsoft, Netwrix

July 11: 5 New Vulns | CVE-2023-32049, CVE-2023-35311, CVE-2023-36874, CVE-2023-32046, CVE-2022-31199

In this CISA KEV Breakdown, four known-to-be-exploited vulnerabilities with two being 0-days from Microsoft’s July patch Tuesday update find their home in the KEV, as well as a Netwrix Auditor bug from 2022. For some by-the-numbers reporting related to patch Tuesday, check out BleepingComputer’s piece here.

Notable Vulnerability Additions

CVE-2023-32049 | Microsoft Defender SmartScreen Security Bypass

A vulnerability in Defender SmartScreen was one of six vulnerabilities known to be exploited from this patch Tuesday, this feature has been long known to be continuously tested by attackers to bypass. Three bypass vulnerabilities now belong to the KEV from this technology alone.

Exploit code does not appear to be publicly available at this time, however vulnerabilities like this are typically popular for security researchers post-disclosure to release writeups detailing the bug.

It can be considered a testament to the fact that attackers, given one of the most common attack vectors in existence, will continue to find ways to streamline it.

This technology is one of many roadblocks that attackers continuously overcome as a means to deliver phishing emails in which the malicious attachment or landing URL attempts to bypass the ‘Open File’ popup from Defender when a suspicious file is opened.

Vulnerabilities such as this are when security teams should ensure strong defense-in-depth approaches are in place when a situation occurs causing a user to be exploited by this attack. This popup should be one of many more roadblocks for the attacker, and not the final one.

Security Advisory(s):

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049

CVE-2023-35311 | Microsoft Outlook Security Bypass

A vulnerability in the Outlook application’s preview pane security features can allow an attacker to exploit a user’s Outlook application by convincing a user to click a malicious URL. Exploit code does not appear to be publicly available at this time. Typically, vulnerabilities such as this and CVE-2023-32049 are quick to be incorporated into phishing campaigns. Exploit code does not appear to be publicly available at this time.

This vulnerability affects multiple versions of Outlook, and luckily requires user interaction to be exploited by an attacker. Typically vulnerabilities such as this that pose a far higher risk are when the preview pane is specifically affected in a way that previewing the email exploits the Outlook application to execute arbitrary commands.

Security Advisory(s):

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311

CVE-2023-36874 | Microsoft Error Reporting Privilege Escalation

A vulnerability in multiple Windows (10, 11) and Windows Server (2008, 2012, 2019, 2022) versions can allow an attacker to exploit and gain adminstrator privileges. Exploit code does not appear publicly available at this time. Limited information exists as to the attack path for the Error Reporting functionality to cause escalation to administrator.

The folks over at Google TAG were first to discover this 0-day as well as CVE-2023-36884, which does not appear to have been added to the KEV yet. This is likely due to the fact that current mitigation surrounding CVE-2023-36884 is not yet a complete patch, but a recommended workaround from Microsoft in their blog linking exploitation of the flaw to Storm-0978.

Security Advisory(s):

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874

CVE-2023-32046 | Microsoft MSHTML Privilege Escalation

A vulnerability in the Windows MSHTML platform in multiple Windows (10, 11) and Windows Server (2008, 2012, 2019, 2022) versions can allow an attacker to escalate privileges. The vulnerability appears to require user interaction according to the details released by Microsoft.

Exploit code does not appear to be publicly available at this time, and much like CVE-2023-36884 there exists little information as to how this is exploited.

Microsoft MSHTML has been historically exploited in similar capacity to the other discussed vulnerabilities, in that user interaction through clicking a malicious attachment or interacting with a malicious landing page causes the user to execute malicious code with elevated privileges for the attacker.

Security Advisory(s):

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046

CVE-2022-31199 | Netwrix Auditor Code Execution

With the highest EPSS score of the bunch, the Netwrix Auditor contains a vulnerability prior to version 10.5 that a remote attacker can exploit to execute arbitrary code. This vulnerability was included in a joint advisory by CISA and other federal agencies. It was reported in the advisory that the vulnerability was used as a means of initial access by threat actors deploying Truebot malware.

If an actor were able to deploy Truebot malware for command and control, the file renames itself and loads FlawedGrace, in hopes to escalate privileges as well as establish persistence. Due to the extensive understanding of the attack path in public knowledge, and the fact that a remote unauthenticated actor can perform exploitation, organizations should be greatly encouraged to move Auditor boxes off the public internet, and to update to non-vulnerable version 10.5.10977.0+.

Security Advisory(s):

Requires login information: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003

← July 7, 2023 CISA Kev Breakdown