CVE-2023-35349 Overview
CVE-2023-35349 is a remote code execution vulnerability in the Microsoft Message Queuing (MSMQ) service. An unauthenticated attacker can send a specially crafted malicious MSMQ packet to a vulnerable server to trigger arbitrary code execution. The flaw affects supported versions of Windows 10, Windows 11, and Windows Server from 2008 through 2022. Microsoft assigned this vulnerability a CVSS v3.1 score of 9.8 and classifies the weakness under [CWE-20] Improper Input Validation. Exploitation requires no user interaction and no privileges, making any host that exposes TCP port 1801 reachable to attackers a viable target.
Critical Impact
Unauthenticated attackers can achieve remote code execution at the privilege level of the MSMQ service across all supported Windows client and server platforms.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2)
- Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-10-10 - CVE-2023-35349 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-35349
Vulnerability Analysis
The vulnerability resides in the Microsoft Message Queuing service, a legacy messaging protocol used for asynchronous communication between Windows applications. MSMQ listens on TCP port 1801 by default when the Windows feature is enabled. Improper input validation [CWE-20] within the service's packet-parsing logic allows malformed protocol data to corrupt internal state and divert execution.
The service runs as mqsvc.exe under elevated privileges, so successful exploitation yields code execution in a high-privilege context. Because MSMQ accepts traffic from the network without authentication, the attack surface extends to any reachable Windows host with the feature installed. MSMQ is not enabled by default but is commonly required by enterprise applications, including some Microsoft Exchange and SQL Server deployments.
Root Cause
The root cause is improper validation of fields within MSMQ protocol packets handled by the service. Untrusted input received over the network is processed without sufficient bounds or structure checks, leading to memory corruption that an attacker can shape into code execution.
Attack Vector
An attacker sends a crafted MSMQ packet to TCP port 1801 on a vulnerable host. No authentication, user interaction, or pre-existing foothold is required. Hosts exposing MSMQ to the internet or to untrusted network segments are at immediate risk; internal exploitation is viable for any attacker with network reachability to the service. Technical details of the packet structure required for exploitation are not publicly disclosed. Refer to the Microsoft CVE-2023-35349 Advisory for further information.
Detection Methods for CVE-2023-35349
Indicators of Compromise
- Unexpected inbound connections to TCP port 1801 from external or untrusted sources
- Crashes, restarts, or abnormal memory growth of the mqsvc.exe process
- Child processes spawned by mqsvc.exe (for example, cmd.exe, powershell.exe, or rundll32.exe)
- Outbound network connections originating from mqsvc.exe to unfamiliar destinations
Detection Strategies
- Inventory all hosts with the Message Queuing Windows feature installed and identify those exposing TCP port 1801
- Alert on process-tree anomalies where mqsvc.exe launches scripting, command, or LOLBin processes
- Monitor Windows Service Control Manager events for unexpected MSMQ service stops, starts, or crashes
- Correlate network telemetry showing port 1801 traffic from outside expected application peers
Monitoring Recommendations
- Capture and retain network flow data for TCP/1801 at perimeter and east-west sensors
- Enable detailed process creation logging (Windows Event ID 4688) and Sysmon on hosts running MSMQ
- Track Windows Update compliance for the October 2023 cumulative updates across all Windows builds
How to Mitigate CVE-2023-35349
Immediate Actions Required
- Apply the October 2023 Microsoft security updates that address CVE-2023-35349 to all affected Windows client and server builds
- Audit systems for the Message Queuing feature and remove it where not required by a business application
- Block inbound TCP port 1801 at perimeter firewalls and restrict internal access to known MSMQ peers
Patch Information
Microsoft released patches for CVE-2023-35349 across all supported Windows versions. Patch availability and KB identifiers per build are documented in the Microsoft CVE-2023-35349 Advisory. Administrators should validate that the relevant cumulative update is installed on each affected host.
Workarounds
- Disable the Message Queuing Windows feature on hosts where it is not required, which stops the mqsvc.exe service and closes TCP port 1801
- Restrict TCP/1801 traffic with Windows Firewall rules so that only authorized application servers can connect to MSMQ endpoints
- Segment MSMQ-dependent systems into isolated network zones with strict ingress controls
# Check whether the MSMQ feature is installed and the service is listening
Get-WindowsFeature -Name MSMQ
Get-Service -Name MSMQ
netstat -ano | findstr :1801
# Disable the feature if MSMQ is not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart
# Restrict TCP/1801 to trusted application servers only
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
