CVE-2023-35366: Windows 10 1507 RRAS RCE Vulnerability

CVE-2023-35366 Overview

CVE-2023-35366 is a critical Remote Code Execution vulnerability affecting the Windows Routing and Remote Access Service (RRAS). This vulnerability allows unauthenticated attackers to execute arbitrary code on affected Windows systems over the network without any user interaction. The RRAS component is commonly deployed in enterprise environments to provide VPN connectivity, network address translation (NAT), and routing capabilities, making this vulnerability particularly concerning for organizations relying on these services.

Critical Impact

Successful exploitation enables complete system compromise, allowing attackers to execute arbitrary code with SYSTEM-level privileges on vulnerable Windows servers and workstations with RRAS enabled.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2)
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• July 11, 2023 - CVE-2023-35366 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-35366

Vulnerability Analysis

This vulnerability exists within the Windows Routing and Remote Access Service (RRAS), a core Windows networking component responsible for handling routing protocols, VPN connections, and remote access functionality. The flaw is categorized under CWE-20 (Improper Input Validation), indicating that the RRAS service fails to properly validate input data before processing it.

The vulnerability can be exploited remotely over the network without requiring any form of authentication or user interaction. An attacker who successfully exploits this vulnerability could gain the ability to execute arbitrary code in the context of the RRAS service, which typically runs with elevated SYSTEM privileges. This provides complete control over the affected system.

Organizations with internet-facing RRAS deployments, particularly those using the service for VPN gateway functionality, face elevated risk as the attack surface is directly exposed to potential threat actors.

Root Cause

The root cause of CVE-2023-35366 lies in improper input validation within the RRAS service. When processing certain network requests, the service fails to adequately validate input parameters, allowing specially crafted data to trigger unintended code execution paths. This lack of proper boundary checking and input sanitization creates an exploitable condition that attackers can leverage to achieve code execution.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no prior authentication or privileges on the target system. An attacker can exploit this vulnerability by sending specially crafted network packets to a Windows system running the RRAS service. The attack does not require any user interaction, making it particularly dangerous in automated attack scenarios.

The exploitation process involves:

1. Identifying a target system with the RRAS service enabled and accessible over the network
2. Crafting malicious network packets designed to trigger the input validation flaw
3. Sending the crafted packets to the target RRAS service
4. Achieving code execution with SYSTEM privileges upon successful exploitation

For detailed technical information on the vulnerability mechanism and exploitation vectors, refer to the Microsoft Security Update Guide for CVE-2023-35366.

Detection Methods for CVE-2023-35366

Indicators of Compromise

• Unusual network traffic patterns targeting RRAS service ports (TCP/IP ports used by routing protocols and VPN services)
• Unexpected child processes spawned by svchost.exe hosting the RRAS service
• Anomalous behavior or crashes of the RemoteAccess service
• Suspicious outbound connections from systems running RRAS to unknown external IP addresses

Detection Strategies

• Monitor Event Logs for RRAS service failures, unexpected restarts, or error events related to the RemoteAccess service
• Implement network intrusion detection rules to identify malformed packets targeting RRAS
• Deploy endpoint detection solutions to monitor for suspicious process creation chains originating from RRAS-related services
• Review Windows Security Event Logs for privilege escalation attempts following RRAS service anomalies

Monitoring Recommendations

• Enable verbose logging for the RRAS service and review logs regularly for signs of exploitation attempts
• Implement network segmentation to limit exposure of RRAS services to trusted networks only
• Configure SIEM correlation rules to alert on combinations of RRAS service errors and subsequent suspicious system activity
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities following potential RRAS compromise

How to Mitigate CVE-2023-35366

Immediate Actions Required

• Apply the Microsoft security update from July 2023 Patch Tuesday immediately on all affected systems
• Disable the RRAS service on systems where it is not required for business operations
• Restrict network access to RRAS services using firewall rules to limit exposure to trusted networks only
• Implement network segmentation to isolate systems running RRAS from critical infrastructure

Patch Information

Microsoft released security updates addressing CVE-2023-35366 as part of the July 2023 security update cycle. Organizations should apply the relevant cumulative updates for their Windows versions immediately. Detailed patch information and download links are available in the Microsoft Security Update Guide for CVE-2023-35366.

Workarounds

• Disable the Routing and Remote Access Service (RemoteAccess) on systems where it is not actively required
• Implement strict firewall rules to block external access to RRAS service ports
• Deploy VPN and remote access solutions through alternative secure methods until patches can be applied
• Monitor systems with RRAS enabled for signs of exploitation while awaiting patch deployment

# Disable RRAS service if not required
sc config RemoteAccess start= disabled
sc stop RemoteAccess

# Verify service status
sc query RemoteAccess