CVE-2023-28303: Snip & Sketch Information Disclosure Flaw

CVE-2023-28303 Overview

CVE-2023-28303 is an information disclosure vulnerability affecting Microsoft's Windows Snipping Tool and Snip & Sketch applications. This vulnerability, commonly referred to as "aCropalypse," allows attackers to potentially recover portions of cropped or edited screenshots that were believed to have been permanently removed. When a user crops an image using these tools and saves it, the original image data may not be fully purged from the file, leaving sensitive information recoverable.

Critical Impact

Sensitive information that users believed was cropped out of screenshots may remain in the file and could be recovered by malicious actors, potentially exposing confidential data, personal information, or credentials.

Affected Products

• Microsoft Snipping Tool
• Microsoft Snip & Sketch

Discovery Timeline

• 2023-06-13 - CVE CVE-2023-28303 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-28303

Vulnerability Analysis

This vulnerability stems from how the Windows Snipping Tool and Snip & Sketch applications handle file operations when users edit and save cropped images. When a PNG screenshot is captured and subsequently cropped to remove portions of the image, the application saves the cropped version by overwriting the original file. However, if the cropped image is smaller than the original, the trailing data from the original image remains appended to the file.

PNG files contain an IEND chunk that marks the end of valid image data. Standard image viewers stop reading at this marker, displaying only the cropped content. However, the original pixel data persists beyond the IEND chunk, allowing specialized tools to reconstruct portions or all of the original uncropped image.

This is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), as it allows unintended disclosure of information users intended to remove from their screenshots.

Root Cause

The root cause lies in the file handling mechanism used by the Snipping Tool and Snip & Sketch applications. When overwriting an existing image file with a cropped version, the applications fail to truncate the file to the new, smaller size. The file stream is opened in a mode that preserves the original file size when the new content is smaller, leaving remnant data from the original screenshot beyond the end of the new PNG structure.

Attack Vector

The attack vector is local, requiring user interaction. An attacker would need to obtain a cropped screenshot file that was processed by the vulnerable applications. This could occur through various scenarios:

• A user shares a cropped screenshot via email, messaging apps, or cloud storage
• Files uploaded to websites or social media platforms that preserve original file data
• Screenshots stored on shared drives or backup locations
• Files extracted from compromised systems or data breaches

Once obtained, an attacker can use recovery tools to analyze the file structure and extract the hidden pixel data that exists beyond the PNG IEND marker, potentially revealing sensitive information the user intended to hide.

Detection Methods for CVE-2023-28303

Indicators of Compromise

• PNG files with file sizes significantly larger than expected for their visible dimensions
• PNG files containing data after the IEND chunk marker
• Screenshot files with mismatched metadata between visible content and file properties
• Evidence of image recovery tools being executed on systems

Detection Strategies

• Implement file integrity monitoring to detect PNG files with anomalous size-to-dimension ratios
• Deploy endpoint detection rules that identify tools commonly used for PNG data recovery or forensic analysis
• Monitor for batch processing of screenshot files that could indicate systematic data extraction attempts
• Scan shared file repositories for PNG files exhibiting signs of incomplete truncation

Monitoring Recommendations

• Monitor outbound file transfers for PNG files originating from the Snipping Tool or Snip & Sketch applications
• Implement data loss prevention (DLP) policies to scan screenshots before sharing
• Log and audit access to directories commonly used for screenshot storage
• Alert on unusual patterns of PNG file access or modification across the organization

How to Mitigate CVE-2023-28303

Immediate Actions Required

• Update Microsoft Snipping Tool and Snip & Sketch to the latest patched versions from the Microsoft Store
• Review and re-process any previously shared cropped screenshots that may contain sensitive information
• Implement organizational policies requiring screenshots with sensitive data be created fresh rather than edited/cropped
• Consider using alternative image editing tools that properly truncate files when resizing

Patch Information

Microsoft has released security updates to address this vulnerability. Users should update to the following minimum versions:

• Snip & Sketch: Version 11.2302.20.0 or later
• Snipping Tool: Version 11.2302.20.0 or later (for Windows 11)

Updates are available through the Microsoft Store. Organizations can verify installed versions through the Microsoft Store app or via PowerShell queries. See the Microsoft Security Update Guide for complete details.

Workarounds

• Save cropped screenshots to a new file rather than overwriting the original
• Use third-party image editors that properly handle file truncation when resizing images
• Manually verify file sizes after cropping to ensure no excess data remains
• Consider using screenshot tools that create new files by default rather than editing in place
• For highly sensitive content, redact information before capturing the screenshot rather than cropping afterward

# Verify Snipping Tool version via PowerShell
Get-AppxPackage -Name *SnippingTool* | Select-Object Name, Version

# Verify Snip & Sketch version
Get-AppxPackage -Name *ScreenSketch* | Select-Object Name, Version

# Update applications via Microsoft Store (requires manual Store access)
# Or use winget for command-line updates
winget upgrade --id 9MZ95KL8MR0L