CVE-2023-29335: Microsoft Word Auth Bypass Vulnerability

CVE-2023-29335 Overview

CVE-2023-29335 is a security feature bypass vulnerability in Microsoft Word that allows attackers to circumvent built-in protections such as Mark of the Web (MOTW) and Protected View. Microsoft published the advisory on May 9, 2023, as part of the May Patch Tuesday release. Exploitation requires user interaction, where a target opens a specially crafted Word document delivered through email, web download, or shared storage. Successful exploitation bypasses warning prompts that normally prevent untrusted documents from executing active content. The flaw is tracked under [CWE-20: Improper Input Validation] and impacts Microsoft Word, Office, Microsoft 365 Apps, and supported Windows desktop and server platforms.

Critical Impact
Attackers can bypass Microsoft Word security protections to deliver weaponized documents that evade Protected View and Mark of the Web checks, enabling follow-on code execution chains.

Affected Products

Microsoft Word 2013, 2013 SP1 (RT), and Word 2016
Microsoft Office 2019, Office 2021 LTSC, and Microsoft 365 Apps for Enterprise
Microsoft Windows 10 (1507 through 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008 through 2022

Discovery Timeline

2023-05-09 - CVE-2023-29335 published to NVD and Microsoft releases security update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-29335

Vulnerability Analysis

The vulnerability resides in how Microsoft Word validates document content and metadata before applying its security feature protections. An attacker crafts a Word document that suppresses or evades the Protected View sandbox and Mark of the Web tagging that Windows applies to files from untrusted zones. When the target opens the document, Word fails to invoke the expected security prompt, allowing embedded content to load without user warning. The bypass does not grant code execution on its own. Adversaries typically chain it with a secondary exploit, macro abuse, or template injection to achieve full compromise. The flaw is classified as Improper Input Validation [CWE-20], reflecting Word's failure to correctly process file attributes that govern trust decisions.

Root Cause

Microsoft Word does not consistently enforce the security policies tied to file origin metadata. Documents that should trigger Protected View are parsed and rendered through code paths that skip the relevant security checks. This logic gap allows specially formed files to be treated as trusted.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker delivers the malicious document via phishing email, watering-hole sites, instant messaging, or file-sharing platforms. The victim must open the document for the bypass to take effect. No prior privileges on the target system are required.

No public proof-of-concept code is referenced in the NVD entry. See the Microsoft Security Update Guide for vendor technical detail.

Detection Methods for CVE-2023-29335

Indicators of Compromise

Word documents (.docx, .doc, .rtf) arriving from external sources that open without triggering Protected View when expected.
Office processes (winword.exe) spawning child processes such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe shortly after document open.
Outbound network connections initiated by winword.exe to unfamiliar domains or IP addresses immediately after a document is opened.

Detection Strategies

Hunt for Word child-process chains that bypass typical macro warnings, correlating file origin (Zone.Identifier alternate data stream) with execution telemetry.
Inspect inbound email attachments and downloaded documents for structural anomalies in OOXML containers, embedded objects, and template references.
Alert on registry or policy changes that disable Protected View, MOTW propagation, or Office Trusted Locations.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction (ASR) rules covering Office child-process creation and executable content from email.
Forward Office telemetry and Sysmon process-creation events to a centralized log platform for correlation.
Track patch compliance for the May 2023 cumulative updates across all Office and Windows builds in scope.

How to Mitigate CVE-2023-29335

Immediate Actions Required

Deploy the May 9, 2023 Microsoft security updates for affected Word, Office, Microsoft 365 Apps, and Windows builds.
Verify Protected View is enabled for files originating from the Internet, unsafe locations, and Outlook attachments.
Block or quarantine inbound Office documents from untrusted senders at the email gateway pending patch rollout.

Patch Information

Microsoft published the fix in the May 2023 Patch Tuesday release. Refer to the Microsoft Security Update Guide for CVE-2023-29335 for the specific Knowledge Base articles and build numbers that correspond to each affected product version.

Workarounds

Configure Group Policy to block macros in Office files from the Internet and enforce MOTW propagation on archive extraction tools.
Disable ActiveX, OLE, and external content loading in Word until updates are deployed.
Restrict Office document execution to managed file shares and Trusted Locations governed by administrative control.

bash

# Configuration example: enforce Protected View and block Internet-origin macros via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f