CVE-2023-24953: Microsoft Excel RCE Vulnerability

CVE-2023-24953 Overview

CVE-2023-24953 is a remote code execution vulnerability affecting Microsoft Excel and related Microsoft Office products. This Use After Free (CWE-416) vulnerability enables attackers to execute arbitrary code on affected systems when a user opens a specially crafted Excel file. The attack requires local access and user interaction, making it a prime candidate for social engineering campaigns targeting enterprise environments.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, and lateral movement within enterprise networks.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Excel 2013 SP1 (including RT edition)
• Microsoft Excel 2016
• Microsoft Office 2019 (Windows and macOS)
• Microsoft Office LTSC 2021 (Windows and macOS)
• Microsoft Office Online Server

Discovery Timeline

• 2023-05-09 - CVE-2023-24953 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-24953

Vulnerability Analysis

This vulnerability stems from a Use After Free (UAF) memory corruption issue within Microsoft Excel's document parsing functionality. When Excel processes a maliciously crafted spreadsheet file, the application may reference memory that has already been freed, leading to undefined behavior that attackers can leverage for code execution.

The exploitation path requires an attacker to convince a user to open a specially crafted Excel file, either through email attachments, malicious downloads, or compromised file shares. Once the file is opened, the vulnerability triggers during the parsing process, allowing the attacker's code to execute within the context of the Excel application.

The impact is significant as successful exploitation grants the attacker the same privileges as the logged-in user. In enterprise environments where users often have elevated permissions or access to sensitive data, this vulnerability poses substantial risk for data exfiltration, ransomware deployment, and establishment of persistent access.

Root Cause

The root cause is a Use After Free (CWE-416) condition in Microsoft Excel's memory management routines. When processing certain document elements, Excel frees a memory object but fails to properly invalidate references to that memory location. Subsequent operations that access this dangling pointer can result in arbitrary memory manipulation, which attackers can exploit to redirect execution flow or inject malicious code.

Attack Vector

The attack vector is local with required user interaction. An attacker must craft a malicious Excel file (.xlsx, .xlsm, .xlsb, or legacy formats) containing elements designed to trigger the Use After Free condition. The attacker then delivers this file to the target through various methods:

1. Email phishing - Sending the malicious file as an attachment with a convincing pretext
2. Watering hole attacks - Hosting the file on compromised websites frequented by targets
3. File share compromise - Placing the malicious file on network shares accessed by the victim
4. Supply chain attacks - Embedding the exploit in seemingly legitimate business documents

When the victim opens the file in a vulnerable version of Excel, the code execution occurs automatically during document parsing without requiring additional actions such as enabling macros.

Detection Methods for CVE-2023-24953

Indicators of Compromise

• Unusual Excel process behavior including unexpected child processes spawned by EXCEL.EXE
• Excel crashes or unexpected termination events when opening specific documents
• Network connections initiated from Excel processes to unknown external IP addresses
• Presence of suspicious .xlsx, .xlsm, or .xlsb files in email attachments or download folders
• Windows Event Log entries indicating application crashes with memory access violations in Excel

Detection Strategies

• Deploy endpoint detection rules to monitor for anomalous behavior from EXCEL.EXE, including shell spawning, PowerShell execution, or network activity
• Implement email gateway scanning for suspicious Excel file attachments with anomalous file structures
• Configure SIEM rules to correlate Excel application crashes with subsequent suspicious process creation
• Enable Microsoft Defender Application Guard for Office to isolate potentially malicious documents

Monitoring Recommendations

• Monitor Windows Event Logs for Application Error events (Event ID 1000) involving EXCEL.EXE with exception codes indicating memory corruption
• Track file creation events for Excel documents in common delivery locations such as Downloads, Temp, and email cache folders
• Implement behavioral analysis to detect post-exploitation activities following Excel document access
• Enable Microsoft 365 audit logging to track document access patterns and identify potential delivery attempts

How to Mitigate CVE-2023-24953

Immediate Actions Required

• Apply the latest Microsoft security updates for all affected Office products immediately
• Enable Protected View and block files originating from the internet from opening outside of Protected View
• Configure Attack Surface Reduction (ASR) rules in Microsoft Defender to block Office applications from creating executable content
• Educate users about the risks of opening unsolicited Excel attachments from unknown sources

Patch Information

Microsoft has released security updates to address this vulnerability as part of their May 2023 Patch Tuesday release cycle. Organizations should apply the appropriate updates for their installed Office versions. Detailed patch information and download links are available in the Microsoft Security Update Guide.

The following products require patching:

• Microsoft 365 Apps for Enterprise - Update via Windows Update or Microsoft Update
• Microsoft Office 2019 - Security update KB5002390 or later
• Microsoft Office LTSC 2021 - Security update KB5002389 or later
• Microsoft Excel 2013 SP1 - Security update available via Microsoft Update Catalog
• Microsoft Excel 2016 - Security update available via Microsoft Update Catalog
• Microsoft Office Online Server - Apply the latest cumulative update

Workarounds

• Enable Protected View for all Excel files to prevent automatic code execution when opening documents
• Configure Office to open files from the internet in Application Guard (available with Microsoft 365 E5 or Windows 10/11 Enterprise)
• Block Excel file types at the email gateway for messages originating from untrusted external sources
• Disable automatic document preview in email clients and file explorers to prevent inadvertent triggering

# PowerShell: Enable Protected View for files from the Internet
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -Type DWord

# PowerShell: Enable Protected View for Outlook attachments
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachmentsInPV" -Value 0 -Type DWord

# PowerShell: Block files from unsafe locations
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord