Attacker Value
Very High
CVE-2023-21716
CVE-2023-21716
(Last updated May 29, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Add Assessment
2
Technical Analysis
A vulnerability in Microsoft’s Word wwlib allows attackers to get LCE with the privileges of the victim opens a malicious
RTF document. An attacker would be able to deliver this payload in several ways including as an attachment in spear-phishing attacks.
Affected Versions
This vulnerability affects at least the following versions of Microsoft Office:
- Microsoft Office 365 (Insider Preview – 2211 Build 15831.20122 CTR)
- Microsoft Office 2016 (Including Insider Slow – 1704 Build 8067.2032 CTR)
- Microsoft Office 2013
- Microsoft Office 2010
- Microsoft Office 2007
Acknowledgement
This issue was discovered, analyzed, and reported by Joshua J. Drake (@jduck).
PoC code from @jduck:
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- microsoft
Products
- office 2019,
- office long term servicing channel 2021,
- office online server 2016,
- office web apps 2013,
- sharepoint enterprise server 2013,
- sharepoint enterprise server 2016,
- sharepoint foundation 2013,
- sharepoint server -,
- sharepoint server 2019,
- word 2013
Exploited in the Wild
References
Exploit
PoCs that have not been added by contributors directly have been sourced from:
nomi-sec/PoC-in-GitHub.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
CVE-2023-21716 (https://github.com/gyaansastra/CVE-2023-21716) (Added by AKB Worker)
CVE-2023-21716 (https://github.com/Xnuvers007/CVE-2023-21716) (Added by AKB Worker)
There’s user interaction required here, right?
Yes, in case the exploit code is hidden as an attachment, the user should open that attachment.
arevulnerable too
Note that, even if user interaction is required, it can be minimal. According to Microsoft, the Preview Pane is also an attack vector, which means the user doesn’t need to open the file. Loading the RTF document in the Preview Pane should also trigger the vulnerability.