CVE-2023-36037: Microsoft 365 Apps Auth Bypass Vulnerability

CVE-2023-36037 Overview

CVE-2023-36037 is a security feature bypass vulnerability affecting Microsoft Excel and related Microsoft Office products. This vulnerability allows an attacker to bypass security features in Microsoft Excel when a user opens a specially crafted file. Successful exploitation requires user interaction, typically through social engineering tactics to convince a user to open a malicious Excel file.

Critical Impact

Attackers can bypass security protections in Microsoft Excel, potentially leading to unauthorized access to sensitive data, code execution, or further system compromise when users open malicious spreadsheet files.

Affected Products

• Microsoft 365 Apps (Enterprise Edition, x64 and x86)
• Microsoft Excel 2016 (x64 and x86)
• Microsoft Office 2019 (x64 and x86)
• Microsoft Office Long Term Servicing Channel 2021 (x64, x86, and macOS)

Discovery Timeline

• 2023-11-14 - CVE-2023-36037 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36037

Vulnerability Analysis

This security feature bypass vulnerability exists within Microsoft Excel's file processing mechanisms. The vulnerability allows attackers to circumvent built-in security protections that are designed to prevent malicious code execution or unauthorized data access when processing Excel files.

The attack requires local access and user interaction—meaning an attacker must convince a user to open a specially crafted Excel file. Once the malicious file is opened, the attacker can bypass security features that would normally protect the user from malicious content embedded within spreadsheet documents.

The impact is significant as successful exploitation can lead to high confidentiality, integrity, and availability impacts on the affected system. This makes the vulnerability particularly dangerous in enterprise environments where Excel files are routinely shared and opened.

Root Cause

The root cause involves improper handling of certain elements within Excel files that allows security features to be bypassed. Microsoft has not disclosed specific technical details about the underlying flaw to prevent exploitation, but the vulnerability classification indicates a failure in the security boundary enforcement within Excel's file parsing and execution logic.

Attack Vector

The attack vector is local, requiring an attacker to deliver a malicious Excel file to the target user. Common delivery mechanisms include:

• Phishing emails with malicious Excel attachments
• Compromised file shares containing weaponized spreadsheets
• Drive-by downloads from malicious websites
• Social engineering to convince users to download and open files

Once the victim opens the crafted Excel file, the security feature bypass is triggered without requiring elevated privileges from the user. The attack does not require authentication to the target system, only that the user has access to open Excel files.

Detection Methods for CVE-2023-36037

Indicators of Compromise

• Suspicious Excel files (.xlsx, .xlsm, .xlsb, .xls) received from untrusted sources or unexpected senders
• Excel processes exhibiting unusual behavior such as spawning child processes or making unexpected network connections
• Unexpected modifications to Protected View or Trust Center settings in Microsoft Office applications
• Anomalous file access patterns in directories containing sensitive data following Excel file opening

Detection Strategies

• Monitor for Excel processes (EXCEL.EXE) spawning unexpected child processes or executing suspicious commands
• Implement email gateway rules to scan and quarantine Excel attachments with suspicious characteristics
• Deploy endpoint detection rules that alert on attempts to modify Office security settings programmatically
• Enable and review Microsoft Office audit logs for signs of security feature bypass attempts

Monitoring Recommendations

• Configure SentinelOne to monitor for behavioral indicators associated with Office-based attacks, including document spawning processes
• Implement file integrity monitoring on critical directories to detect unauthorized access following document opening
• Review Windows Event Logs for events related to Microsoft Office applications, particularly those involving macro execution or Protected View bypasses
• Enable enhanced logging for Microsoft Office applications to capture detailed execution telemetry

How to Mitigate CVE-2023-36037

Immediate Actions Required

• Apply Microsoft's November 2023 security updates for all affected Microsoft Office and Excel products immediately
• Enable Protected View for all Office documents from external sources to add an additional layer of protection
• Configure Office Trust Center settings to block macros from the internet and restrict active content
• Educate users about the risks of opening Excel files from untrusted sources

Patch Information

Microsoft has released security patches addressing CVE-2023-36037 as part of the November 2023 Patch Tuesday updates. Organizations should apply the appropriate updates for their installed versions:

• Microsoft 365 Apps for Enterprise: Update through Microsoft Update or WSUS
• Microsoft Excel 2016: Security update available through Microsoft Update
• Microsoft Office 2019: Security update available through Microsoft Update
• Microsoft Office LTSC 2021: Security update available through Microsoft Update

For detailed patch information and download links, refer to the Microsoft Security Update Guide for CVE-2023-36037.

Workarounds

• Configure Microsoft Office to open all files from the internet in Protected View until patches can be applied
• Block Excel file attachments at the email gateway level for high-risk user groups
• Use application allowlisting to prevent unauthorized processes from being spawned by Excel
• Consider deploying Office in a sandboxed environment for users who frequently handle external Excel files

# PowerShell: Enable Protected View for files from the Internet
# Apply via Group Policy or run on individual systems
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value 0 -Type DWord
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value 0 -Type DWord