CVE-2023-36911: Windows 10 MSMQ RCE Vulnerability

CVE-2023-36911 Overview

CVE-2023-36911 is a critical remote code execution vulnerability affecting Microsoft Message Queuing (MSMQ), a Windows component that enables applications to communicate across heterogeneous networks and systems. This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable systems by sending specially crafted packets to the MSMQ service over the network.

The vulnerability is particularly dangerous because it requires no user interaction and can be exploited remotely without authentication. Organizations running Windows systems with MSMQ enabled are at significant risk, as successful exploitation could lead to complete system compromise.

Critical Impact

Unauthenticated remote attackers can achieve complete system compromise including full confidentiality, integrity, and availability impact on affected Windows systems with MSMQ enabled.

Affected Products

• Microsoft Windows 10 (all versions including 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2 - both ARM64 and x64)
• Microsoft Windows Server 2008 (SP2 and R2 SP1)
• Microsoft Windows Server 2012 (including R2)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• August 8, 2023 - CVE-2023-36911 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-36911

Vulnerability Analysis

CVE-2023-36911 is an Integer Overflow vulnerability (CWE-190) in the Microsoft Message Queuing service. The vulnerability exists in how MSMQ processes incoming network packets, where improper handling of integer values can lead to memory corruption conditions. When exploited, this allows attackers to execute arbitrary code in the context of the MSMQ service, which typically runs with SYSTEM privileges.

The attack surface is network-accessible, requiring only that the target system has MSMQ enabled and TCP port 1801 exposed. No authentication credentials are required, and the attack can be executed without any user interaction, making it highly exploitable in enterprise environments where MSMQ is commonly deployed for application integration.

Root Cause

The root cause of this vulnerability is an Integer Overflow (CWE-190) condition in the MSMQ packet processing code. When handling certain fields in incoming MSMQ messages, the service performs arithmetic operations on attacker-controlled values without proper bounds checking. This can cause integer values to wrap around, leading to undersized buffer allocations followed by subsequent buffer overflow conditions when data is copied into the allocated memory.

Attack Vector

The attack vector is network-based, targeting TCP port 1801 which is the default port used by MSMQ. An attacker can exploit this vulnerability by:

1. Identifying systems with MSMQ enabled and port 1801 accessible
2. Crafting malicious MSMQ packets containing specially calculated integer values designed to trigger the overflow
3. Sending the malicious packets to the target MSMQ service
4. The integer overflow causes improper memory allocation, leading to heap corruption
5. Attacker-controlled code execution occurs with SYSTEM privileges

The vulnerability does not require the attacker to be authenticated or have any prior access to the target system. The MSMQ service processes the malicious input before any authentication checks occur, making it a pre-authentication remote code execution vulnerability.

Detection Methods for CVE-2023-36911

Indicators of Compromise

• Unusual network traffic to TCP port 1801 from external or unexpected sources
• MSMQ service crashes or unexpected restarts (mqsvc.exe)
• Suspicious process spawning from mqsvc.exe parent process
• Memory corruption artifacts or access violations in Windows Event logs related to MSMQ

Detection Strategies

• Monitor network traffic for anomalous MSMQ protocol communications on TCP port 1801
• Deploy intrusion detection/prevention system rules to detect malformed MSMQ packets
• Enable and monitor Windows Event logs for MSMQ service errors and crashes
• Use endpoint detection and response (EDR) solutions to identify suspicious process behavior originating from mqsvc.exe

Monitoring Recommendations

• Configure firewall logging for all traffic to TCP port 1801
• Enable process creation auditing to track processes spawned by MSMQ service
• Monitor for unauthorized network connections from Windows MSMQ services
• Implement network segmentation monitoring to detect lateral movement attempts using MSMQ

How to Mitigate CVE-2023-36911

Immediate Actions Required

• Apply the Microsoft security update for CVE-2023-36911 immediately on all affected systems
• If MSMQ is not required, disable the Message Queuing service on all Windows systems
• Block TCP port 1801 at network perimeter firewalls to prevent external exploitation
• Audit all systems to identify where MSMQ is enabled and assess business necessity

Patch Information

Microsoft has released security updates to address CVE-2023-36911 as part of the August 2023 Patch Tuesday release. Administrators should consult the Microsoft Security Update Guide for CVE-2023-36911 for specific patch information and download links for each affected Windows version. The patches address the integer overflow vulnerability by implementing proper bounds checking on input values during MSMQ packet processing.

Workarounds

• Disable the Message Queuing service if not required: Set the MSMQ service startup type to Disabled via Services console or Group Policy
• Block inbound connections to TCP port 1801 using Windows Firewall or network firewalls
• Implement network segmentation to isolate systems requiring MSMQ from untrusted networks
• Use host-based firewall rules to restrict MSMQ access to only trusted application servers

# PowerShell: Check if MSMQ is installed and running
Get-Service -Name MSMQ -ErrorAction SilentlyContinue

# PowerShell: Disable MSMQ service if not needed
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled

# PowerShell: Block TCP port 1801 using Windows Firewall
New-NetFirewallRule -DisplayName "Block MSMQ Inbound" -Direction Inbound -LocalPort 1801 -Protocol TCP -Action Block