CVE-2023-36568: Microsoft 365 Apps Privilege Escalation

CVE-2023-36568 Overview

CVE-2023-36568 is an Elevation of Privilege vulnerability affecting Microsoft Office Click-To-Run deployment technology. This vulnerability allows a locally authenticated attacker to escalate privileges on the affected system, potentially gaining elevated access beyond their originally assigned permissions. The Click-To-Run technology is Microsoft's streaming and virtualization technology used for deploying and updating Office products, making this vulnerability particularly concerning for enterprise environments with widespread Office deployments.

Critical Impact

Successful exploitation enables authenticated local attackers to escalate privileges, potentially compromising system integrity, confidentiality, and availability through unauthorized elevated access.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Microsoft Office Long Term Servicing Channel 2021

Discovery Timeline

• 2023-10-10 - CVE-2023-36568 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36568

Vulnerability Analysis

This elevation of privilege vulnerability exists within the Microsoft Office Click-To-Run component. The vulnerability is categorized under CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack vulnerability. This weakness class indicates that the vulnerable component improperly handles file operations involving symbolic links, allowing an attacker to redirect file operations to unintended locations.

The attack requires local access and low-level privileges to initiate, though it has high attack complexity, meaning specific conditions must be met for successful exploitation. Once exploited, the attacker can achieve high impact across confidentiality, integrity, and availability of the affected system, potentially gaining elevated privileges that could be used for further malicious activities.

Root Cause

The root cause of CVE-2023-36568 stems from improper link resolution before file access (CWE-59) in the Microsoft Office Click-To-Run component. This type of vulnerability occurs when software processes follow symbolic or hard links without properly verifying the legitimacy of the target destination. An attacker can create malicious symbolic links that redirect file operations performed by the privileged Click-To-Run service to arbitrary file system locations, enabling privilege escalation.

Attack Vector

The attack vector for CVE-2023-36568 is local, requiring the attacker to have authenticated access to the target system with low-level privileges. The exploitation involves manipulating symbolic links or other file system constructs that the Click-To-Run component processes during its normal operations. Due to the high attack complexity, successful exploitation depends on timing conditions or specific system configurations being present. The attacker would need to:

1. Gain local access to a system with vulnerable Microsoft Office installations
2. Create strategically placed symbolic links targeting privileged operations
3. Trigger the Click-To-Run component to process these malicious links
4. Exploit the improper link resolution to perform privileged file operations

The vulnerability can be exploited without any user interaction once the attacker has local access.

Detection Methods for CVE-2023-36568

Indicators of Compromise

• Unusual symbolic link creation in directories associated with Microsoft Office Click-To-Run operations
• Unexpected file system activity by OfficeClickToRun.exe or related service processes
• Privilege escalation attempts following Office update or maintenance operations
• Anomalous registry modifications in Office-related keys by non-administrative users

Detection Strategies

• Monitor for symbolic link creation events in Office installation and temporary directories using file integrity monitoring tools
• Implement endpoint detection rules for unusual process behavior by Click-To-Run service components
• Deploy SentinelOne Singularity Platform to detect and respond to privilege escalation attempts in real-time
• Configure Windows Event Log auditing for file system operations involving Office directories

Monitoring Recommendations

• Enable advanced audit policies for file system access, particularly Audit File System and Audit Handle Manipulation
• Implement behavioral analysis monitoring for Office processes attempting operations outside expected scope
• Establish baseline behavior for Click-To-Run service operations and alert on deviations
• Utilize SentinelOne's behavioral AI to identify anomalous elevation attempts associated with Office components

How to Mitigate CVE-2023-36568

Immediate Actions Required

• Apply the latest security updates from Microsoft for all affected Office products immediately
• Restrict local access to systems with vulnerable Office installations until patches are applied
• Review and audit user privileges to ensure principle of least privilege is enforced
• Enable SentinelOne protection on all endpoints to detect and prevent exploitation attempts

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should apply the patches available through the Microsoft Security Response Center Advisory. For Click-To-Run installations, updates can be applied through the standard Office update mechanisms, while LTSC installations may require manual update deployment through Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager.

Workarounds

• Limit local access to systems with vulnerable Office installations to trusted users only
• Implement application control policies to restrict symbolic link creation in Office directories
• Enable Windows Defender Credential Guard and other virtualization-based security features
• Monitor file system operations for suspicious symlink activity targeting Office components

# Verify current Office version and update channel
# Run in PowerShell as Administrator
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" | Select-Object -Property VersionToReport, UpdateChannel

# Force Office Click-To-Run update check
& "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user