CVE-2023-36910: Windows 10 MSMQ RCE Vulnerability

CVE-2023-36910 Overview

CVE-2023-36910 is a critical remote code execution vulnerability affecting Microsoft Message Queuing (MSMQ), a messaging protocol that enables applications running on separate servers to communicate in a failsafe manner. This vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable Windows systems where the MSMQ service is enabled.

The vulnerability is particularly dangerous because it requires no user interaction and can be exploited over the network without authentication. MSMQ, while not enabled by default on most Windows installations, is commonly deployed in enterprise environments for application integration, transaction processing, and distributed system communication.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise by sending specially crafted packets to the MSMQ service, potentially leading to full control over affected Windows systems.

Affected Products

• Microsoft Windows 10 (all versions including 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2 - both ARM64 and x64 architectures)
• Microsoft Windows Server 2008 (SP2 and R2 SP1)
• Microsoft Windows Server 2012 (including R2)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• August 8, 2023 - CVE-2023-36910 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-36910

Vulnerability Analysis

This remote code execution vulnerability resides in the Microsoft Message Queuing service, a core Windows component used for asynchronous messaging between distributed applications. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound), indicating a fundamental flaw in how the MSMQ service handles numeric values during message processing.

The attack can be initiated remotely over the network without requiring any form of authentication or user interaction. An attacker who successfully exploits this vulnerability could execute arbitrary code with SYSTEM-level privileges on the target machine, resulting in complete system compromise.

The broad scope of affected products, spanning from legacy Windows Server 2008 to modern Windows 11 systems, indicates that this vulnerability exists in core MSMQ functionality that has been present across multiple Windows generations.

Root Cause

The root cause of CVE-2023-36910 is an integer overflow vulnerability (CWE-190) within the MSMQ service's message processing logic. Integer overflow conditions occur when arithmetic operations produce values that exceed the maximum storage capacity of the data type being used.

In the context of MSMQ, this overflow likely occurs during buffer size calculations or memory allocation operations when processing incoming messages. When an attacker sends specially crafted messages containing malicious size parameters, the integer overflow can cause the service to allocate an insufficient buffer, subsequently leading to memory corruption conditions that enable code execution.

Attack Vector

The attack vector for CVE-2023-36910 is network-based, targeting TCP port 1801, which is the default listening port for the MSMQ service. The exploitation workflow involves:

1. The attacker identifies a Windows system with the MSMQ service running and accessible over the network
2. Specially crafted MSMQ packets are constructed to trigger the integer overflow condition
3. These malicious packets are transmitted to the target system's MSMQ service
4. The integer overflow leads to improper memory allocation, causing a heap or buffer overflow
5. Through careful manipulation of the overflow, the attacker achieves arbitrary code execution with SYSTEM privileges

The vulnerability does not require any authentication credentials or user interaction, making it highly exploitable in environments where MSMQ services are exposed to untrusted networks.

Detection Methods for CVE-2023-36910

Indicators of Compromise

• Unexpected network connections to TCP port 1801 from external or untrusted sources
• Anomalous MSMQ service behavior including crashes, restarts, or unexpected child processes
• Memory corruption artifacts or crash dumps from the mqsvc.exe process
• Suspicious processes spawned as children of the MSMQ service process

Detection Strategies

• Monitor network traffic for unusual patterns or malformed packets targeting TCP port 1801
• Implement intrusion detection/prevention system (IDS/IPS) rules to identify MSMQ exploitation attempts
• Deploy endpoint detection and response (EDR) solutions to monitor mqsvc.exe process behavior for signs of code injection or unexpected execution flows
• Configure Windows Event Log auditing for MSMQ-related events and system service anomalies

Monitoring Recommendations

• Enable detailed logging for the MSMQ service and regularly review logs for suspicious activity
• Monitor for unusual outbound network connections from systems running MSMQ services
• Implement network segmentation to isolate MSMQ services from untrusted network segments
• Use SentinelOne's real-time behavioral analysis to detect exploitation attempts and post-exploitation activities

How to Mitigate CVE-2023-36910

Immediate Actions Required

• Apply the Microsoft security update released in August 2023 to all affected systems immediately
• If patching is not immediately possible, disable the MSMQ service on systems where it is not required
• Block TCP port 1801 at network perimeters to prevent external exploitation attempts
• Conduct an inventory to identify all systems with MSMQ enabled across the environment

Patch Information

Microsoft has released security updates to address CVE-2023-36910 as part of their August 2023 Patch Tuesday release. Administrators should consult the Microsoft Security Update Guide for CVE-2023-36910 for detailed patch information specific to their Windows versions.

The patches address the integer overflow condition in the MSMQ service by implementing proper bounds checking and input validation during message processing. Organizations should prioritize patching systems where MSMQ is actively used or exposed to network traffic.

Workarounds

• Disable the Message Queuing service if it is not required for business operations using the Services management console or PowerShell
• Implement strict firewall rules to block inbound traffic to TCP port 1801 from untrusted networks
• Use network segmentation to isolate systems running MSMQ from general network access
• Consider using Windows Firewall with Advanced Security to restrict MSMQ access to specific authorized systems only

# Disable MSMQ service (PowerShell - Run as Administrator)
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled

# Verify MSMQ service status
Get-Service -Name MSMQ | Select-Object Name, Status, StartType

# Block MSMQ port via Windows Firewall (if service must remain enabled)
New-NetFirewallRule -DisplayName "Block MSMQ Inbound" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block -Profile Any