CVE-2023-35349: Windows 10 1507 MSMQ RCE Vulnerability

CVE-2023-35349 Overview

CVE-2023-35349 is a critical remote code execution vulnerability affecting Microsoft Message Queuing (MSMQ), a Windows service that enables asynchronous communication between applications. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable systems where the MSMQ service is enabled, potentially leading to complete system compromise.

Critical Impact

Unauthenticated remote attackers can achieve full system compromise by exploiting MSMQ without any user interaction, affecting a wide range of Windows desktop and server operating systems.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2)
• Microsoft Windows Server 2008 (SP2 and R2 SP1)
• Microsoft Windows Server 2012 (including R2)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• 2023-10-10 - CVE-2023-35349 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-35349

Vulnerability Analysis

This remote code execution vulnerability resides in Microsoft Message Queuing (MSMQ), a core Windows component that provides reliable message delivery for distributed applications. The vulnerability stems from improper input validation (CWE-20) when the MSMQ service processes specially crafted network packets.

The attack can be executed remotely over the network without requiring any prior authentication or user interaction. When successfully exploited, attackers gain the ability to execute code with the privileges of the MSMQ service, which typically runs as SYSTEM. This grants complete control over the compromised machine, enabling attackers to install programs, view and modify data, or create new accounts with full administrative rights.

MSMQ operates on TCP port 1801 by default. Systems with MSMQ enabled and accessible from untrusted networks are particularly at risk. The service is not enabled by default on Windows but is commonly deployed in enterprise environments for application integration scenarios.

Root Cause

The root cause of CVE-2023-35349 is improper input validation within the MSMQ service when handling incoming network messages. The service fails to adequately validate the structure and content of messages received on its network interface, allowing malformed packets to trigger memory corruption or other exploitable conditions. This CWE-20 (Improper Input Validation) flaw enables remote attackers to craft malicious MSMQ packets that bypass security checks and achieve code execution.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker can remotely target any Windows system where:

1. The Message Queuing service is installed and running
2. TCP port 1801 is accessible from the attacker's network position

The exploitation requires no authentication credentials, no user interaction, and can be triggered by sending specially crafted packets to the vulnerable MSMQ service. Organizations with MSMQ exposed to the internet or untrusted network segments face the highest risk of exploitation.

The attack flow involves sending malicious MSMQ protocol messages to port 1801, which are processed by the mqsvc.exe service. Due to insufficient input validation, these messages can corrupt memory or manipulate program flow, ultimately resulting in arbitrary code execution with SYSTEM privileges.

Detection Methods for CVE-2023-35349

Indicators of Compromise

• Unexpected network connections to TCP port 1801 from external or untrusted IP addresses
• Anomalous mqsvc.exe process behavior, including unexpected child processes or high resource utilization
• Evidence of memory corruption or crash dumps associated with the Message Queuing service
• Suspicious processes spawned by SYSTEM account following MSMQ activity

Detection Strategies

• Deploy network intrusion detection rules to monitor for malformed MSMQ protocol traffic on TCP port 1801
• Enable Windows Security Event logging and monitor for Event ID 4688 (process creation) with mqsvc.exe as the parent process
• Implement endpoint detection rules to identify suspicious behavior patterns from the Message Queuing service
• Monitor for exploit signatures in traffic destined to MSMQ service ports

Monitoring Recommendations

• Configure SentinelOne Singularity platform to detect exploitation attempts targeting MSMQ services
• Establish baseline behavior for MSMQ processes and alert on deviations
• Monitor patch compliance across all affected Windows systems to ensure timely remediation
• Implement network segmentation monitoring to detect unauthorized access attempts to MSMQ ports

How to Mitigate CVE-2023-35349

Immediate Actions Required

• Apply the October 2023 Microsoft security updates immediately on all affected systems
• Audit systems to determine where MSMQ is installed and whether it is necessary for business operations
• Disable the Message Queuing service on systems where it is not required
• Block TCP port 1801 at network perimeters if MSMQ access from untrusted networks is not needed

Patch Information

Microsoft has released security updates addressing CVE-2023-35349 as part of the October 2023 Patch Tuesday release. Organizations should obtain the appropriate patches from the Microsoft Security Response Center advisory. The patches address the input validation flaw in the MSMQ service to prevent exploitation.

Patches are available for all supported Windows versions, including Windows 10, Windows 11, Windows Server 2012 through 2022, and extended security updates are available for Windows Server 2008. Organizations running end-of-life Windows versions should prioritize migration to supported platforms.

Workarounds

• Disable the Message Queuing Windows feature if not required: Navigate to Control Panel → Programs → Turn Windows features on or off → uncheck "Microsoft Message Queue (MSMQ) Server"
• Implement firewall rules to block inbound traffic on TCP port 1801 from untrusted networks
• Use network segmentation to isolate systems running MSMQ from internet-facing network zones
• Deploy SentinelOne agents to provide runtime protection against exploitation attempts while patches are being deployed

# Disable MSMQ Service via PowerShell
Stop-Service -Name "MSMQ" -Force
Set-Service -Name "MSMQ" -StartupType Disabled

# Block MSMQ port via Windows Firewall
New-NetFirewallRule -DisplayName "Block MSMQ Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block