CVE-2023-21736: Microsoft 365 Apps RCE Vulnerability

CVE-2023-21736 Overview

CVE-2023-21736 is a Remote Code Execution vulnerability affecting Microsoft Office Visio. This vulnerability allows an attacker to execute arbitrary code on the target system when a user opens a specially crafted Visio file. The flaw stems from improper numeric type conversion (CWE-681: Incorrect Conversion between Numeric Types), which can lead to memory corruption and ultimately code execution in the context of the current user.

Critical Impact

Successful exploitation could allow attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or malware installation.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Microsoft Office Long Term Servicing Channel 2021
• Microsoft Visio 2013 SP1
• Microsoft Visio 2016

Discovery Timeline

• January 10, 2023 - CVE-2023-21736 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-21736

Vulnerability Analysis

This vulnerability is classified under CWE-681 (Incorrect Conversion between Numeric Types), indicating that the root cause involves improper handling of numeric data during type conversion operations within Visio's file parsing routines. When processing specially crafted Visio documents, the application fails to properly validate or convert numeric values, potentially leading to unexpected memory operations.

The local attack vector requires user interaction—specifically, a victim must open a malicious Visio file. Despite requiring user interaction, exploitation does not require any special privileges on the target system. Once the malicious file is opened, the attacker can achieve high impact on confidentiality, integrity, and availability of the affected system.

Root Cause

The vulnerability exists due to an incorrect conversion between numeric types (CWE-681) in Microsoft Visio's document parsing functionality. When Visio processes certain file structures, numeric values may be improperly converted, causing buffer overflows or other memory corruption conditions that can be leveraged for code execution.

Attack Vector

The attack requires local access and user interaction. An attacker would typically deliver a malicious Visio file (.vsd, .vsdx, or similar formats) through phishing emails, malicious websites, or compromised file shares. When the victim opens the specially crafted document with a vulnerable version of Microsoft Visio, the numeric conversion flaw triggers, allowing the attacker's code to execute in the context of the current user.

The exploitation mechanism involves crafting specific numeric values within the Visio file structure that cause incorrect type conversion during parsing. This results in memory corruption that can be exploited to achieve arbitrary code execution. The attack does not require elevated privileges, making it accessible to opportunistic attackers who can deliver malicious files to potential victims.

Detection Methods for CVE-2023-21736

Indicators of Compromise

• Unexpected Visio file attachments in emails from unknown or suspicious senders
• Visio process (visio.exe) spawning unusual child processes or network connections
• Crash dumps or error logs related to Microsoft Visio with memory access violations
• Unusual file activity originating from Visio document directories

Detection Strategies

• Monitor for suspicious Visio file downloads or email attachments with .vsd, .vsdx, .vsdm extensions from untrusted sources
• Implement endpoint detection rules for Visio process anomalies, including unexpected child processes or code injection behavior
• Enable Windows Defender Exploit Guard Attack Surface Reduction rules for Office applications
• Deploy network-level scanning for potentially malicious Visio documents

Monitoring Recommendations

• Configure SIEM alerts for Visio-related process anomalies and crash events
• Enable Office telemetry and crash reporting to identify potential exploitation attempts
• Monitor user workstations for unusual file operations following Visio document access
• Review endpoint protection logs for blocked or suspicious Office document activity

How to Mitigate CVE-2023-21736

Immediate Actions Required

• Apply Microsoft's January 2023 security updates for all affected Office products immediately
• Enable Protected View and Application Guard for Office applications
• Educate users about the risks of opening Visio files from untrusted sources
• Consider blocking Visio file attachments at the email gateway for high-risk environments

Patch Information

Microsoft has released security updates addressing this vulnerability as part of the January 2023 Patch Tuesday release. Organizations should apply the relevant updates for their specific Office and Visio installations. Detailed patch information is available in the Microsoft Security Update Guide for CVE-2023-21736.

For Microsoft 365 Apps for Enterprise and other subscription-based products, ensure automatic updates are enabled to receive the latest security fixes. For standalone Visio installations (2013 SP1, 2016), apply the specific security updates from Microsoft Update Catalog.

Workarounds

• Enable Protected View for files originating from the Internet or untrusted locations in Office Trust Center settings
• Block Visio file types at email gateways and web proxies until patches can be applied
• Restrict Visio file execution through Windows AppLocker or Software Restriction Policies
• Configure Office applications to open files in read-only mode by default

# PowerShell: Enable Protected View for Internet files in Office via registry
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" -Name "DisableAttachmentsInPV" -Value 0 -Type DWord