CVE-2023-35384 Overview
CVE-2023-35384 is a security feature bypass vulnerability in the Windows HTML Platforms component. Microsoft published the advisory on August 8, 2023, covering supported Windows desktop and Server SKUs. The flaw is categorized under [CWE-73] (External Control of File Name or Path), indicating that path handling within HTML platform components can be influenced by attacker-controlled input. Exploitation requires user interaction over the network, typically by convincing a target to open a crafted file or follow a malicious link. Successful exploitation lets an attacker bypass an intended security feature and tamper with integrity-protected resources.
Critical Impact
An attacker who tricks a user into opening a crafted resource can bypass Windows HTML Platforms security controls and impact file integrity on the target host.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2)
- Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, and 2022
Discovery Timeline
- 2023-08-08 - CVE-2023-35384 published to the National Vulnerability Database (NVD)
- 2023-08-08 - Microsoft releases security update guidance for CVE-2023-35384
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-35384
Vulnerability Analysis
The vulnerability resides in the Windows HTML Platforms component, which renders HTML content for various Windows features and applications. Microsoft classifies the flaw as a security feature bypass with high impact to integrity but no direct effect on confidentiality or availability. The advisory maps the issue to [CWE-73], pointing to improper handling of attacker-controllable file or path references during HTML processing. Public reporting links this class of bypass to broader research into the same component that affected Microsoft Outlook and forced authentication scenarios. The Exploit Prediction Scoring System (EPSS) currently places this issue in the lower range of expected exploitation likelihood, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper validation of externally controlled file or path inputs within the Windows HTML Platforms code path. When the component resolves resources referenced by HTML content, it can be coerced into loading or interpreting attacker-controlled paths, which subverts a security check that should prevent that action.
Attack Vector
Exploitation is network-based but requires user interaction. An attacker delivers crafted HTML content, often embedded in an email, document, or hosted web resource. When the target opens or previews the content, Windows HTML Platforms processes the malicious reference and the intended security boundary is bypassed. No privileges are needed prior to the user action.
No verified public proof-of-concept code is available for CVE-2023-35384. Refer to the Microsoft Security Update Guide for CVE-2023-35384 for vendor-supplied technical context.
Detection Methods for CVE-2023-35384
Indicators of Compromise
- Inbound emails or documents containing HTML payloads that reference remote UNC paths, unusual file:// URIs, or unexpected protocol handlers.
- Endpoint telemetry showing Office or mail clients spawning network connections to attacker-controlled SMB or WebDAV hosts shortly after a user opens an attachment.
- Creation or modification of files in user-writable directories immediately following the rendering of received HTML content.
Detection Strategies
- Hunt for outbound SMB (TCP 445) or WebDAV traffic originating from desktop processes such as outlook.exe, explorer.exe, or browser hosts, especially to external destinations.
- Correlate Windows Security event logs for NTLM authentication attempts to external hosts triggered by user-mode applications that render HTML.
- Use EDR process-lineage data to flag HTML platform components loading remote resources outside expected Intranet zones.
Monitoring Recommendations
- Forward Microsoft-Windows-SMBClient and Sysmon network events to your SIEM for continuous review of unusual outbound SMB or WebDAV sessions.
- Track patch compliance across all in-scope Windows 10, Windows 11, and Windows Server builds listed in the Microsoft advisory.
- Monitor mail gateways for HTML content containing remote resource references and quarantine attachments that meet that pattern.
How to Mitigate CVE-2023-35384
Immediate Actions Required
- Apply the August 2023 Microsoft security updates that address CVE-2023-35384 on every affected Windows 10, Windows 11, and Windows Server build.
- Prioritize patching mail servers, jump hosts, and user workstations that routinely render HTML content from external sources.
- Reinforce user awareness on opening unexpected attachments or links, since exploitation requires user interaction.
Patch Information
Microsoft addressed the issue through cumulative updates released on August 8, 2023. Consult the Microsoft Security Update Guide for CVE-2023-35384 for the specific KB numbers tied to each Windows version and apply them through Windows Update, WSUS, or your preferred patch management platform.
Workarounds
- Block outbound SMB (TCP 445) and WebDAV traffic from client subnets to the public Internet at the perimeter firewall to limit remote resource loading.
- Disable NTLM authentication to remote destinations or restrict it using the RestrictSendingNTLMTraffic Group Policy where operationally feasible.
- Configure mail gateways to strip or rewrite HTML elements referencing remote file paths, UNC shares, or unusual URI schemes.
# Example: restrict outbound NTLM via Group Policy registry path
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
