CVE-2023-41763: Skype For Business Privilege Escalation

CVE-2023-41763 Overview

CVE-2023-41763 is an Elevation of Privilege vulnerability affecting Microsoft Skype for Business Server. This vulnerability, classified as CWE-918 (Server-Side Request Forgery), allows an unauthenticated attacker to exploit the server to make requests to internal network resources, potentially disclosing sensitive information. The vulnerability has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Critical Impact

This vulnerability is actively exploited in the wild and listed in CISA's Known Exploited Vulnerabilities catalog. Attackers can leverage this SSRF vulnerability to access internal network resources and potentially expose sensitive configuration data or credentials without authentication.

Affected Products

• Microsoft Skype for Business Server 2015 (Cumulative Update 13 and earlier)
• Microsoft Skype for Business Server 2019 (Cumulative Update 7 and earlier)

Discovery Timeline

• October 10, 2023 - CVE-2023-41763 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2023-41763

Vulnerability Analysis

This vulnerability is a Server-Side Request Forgery (SSRF) issue that enables attackers to trick the Skype for Business Server into making HTTP requests to arbitrary internal endpoints. The attack can be executed remotely over the network without requiring any authentication or user interaction.

The SSRF nature of this vulnerability means that the Skype for Business Server acts as a proxy for the attacker, allowing them to probe and access internal resources that would normally be inaccessible from the external network. This can lead to information disclosure, including potentially sensitive configuration data, internal IP addresses, service banners, and in some cases, credentials or tokens.

Root Cause

The root cause of CVE-2023-41763 lies in improper input validation when the Skype for Business Server processes certain network requests. The server fails to adequately validate and sanitize URLs or network destinations provided in user-controlled input, allowing an attacker to specify arbitrary internal or external endpoints for the server to contact.

This weakness falls under CWE-918: Server-Side Request Forgery (SSRF), where a web application fetches a remote resource based on user-supplied input without properly validating the destination URL.

Attack Vector

The attack vector is network-based, meaning the vulnerability can be exploited remotely by sending specially crafted requests to an exposed Skype for Business Server. The attacker does not need any privileges or credentials to exploit this vulnerability, and no user interaction is required.

An attacker would typically craft malicious requests that cause the Skype for Business Server to reach out to internal network resources, such as:

• Internal web services and APIs
• Cloud metadata endpoints (e.g., Azure IMDS at 169.254.169.254)
• Internal configuration endpoints
• Other internal servers that may expose sensitive information

The response from these internal resources could be reflected back to the attacker, enabling information disclosure about the internal network infrastructure.

Detection Methods for CVE-2023-41763

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from Skype for Business Server to internal IP ranges or cloud metadata endpoints
• Log entries showing requests to unexpected internal resources or services
• Network traffic from the Skype for Business Server to internal addresses that it would not normally communicate with
• Failed or successful connections to 169.254.169.254 (cloud metadata service) from the server

Detection Strategies

• Monitor Skype for Business Server logs for unusual HTTP request patterns targeting internal resources
• Implement network segmentation monitoring to detect when the Skype for Business Server attempts to reach internal services unexpectedly
• Use intrusion detection systems (IDS) to identify SSRF attack patterns in incoming requests
• Review web application firewall (WAF) logs for requests containing internal IP addresses or localhost references

Monitoring Recommendations

• Enable verbose logging on Skype for Business Server to capture all incoming requests and outbound connections
• Set up alerts for any outbound connections from the Skype for Business Server to internal network ranges
• Monitor for exploitation attempts using SIEM solutions with rules specifically targeting SSRF patterns
• Regularly review network flow data for anomalous communication patterns from the server

How to Mitigate CVE-2023-41763

Immediate Actions Required

• Apply the security update from Microsoft immediately as this vulnerability is actively exploited
• Review Skype for Business Server logs for any signs of exploitation
• Implement network segmentation to limit the server's ability to access sensitive internal resources
• Consider adding firewall rules to restrict outbound connections from the Skype for Business Server

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply the appropriate cumulative update for their Skype for Business Server version as soon as possible. Detailed patch information and download links are available in the Microsoft Security Update Guide.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance have mandatory remediation deadlines.

Workarounds

• Implement strict egress filtering on the Skype for Business Server to prevent connections to internal network ranges
• Deploy a web application firewall (WAF) to filter and block potential SSRF payloads in incoming requests
• Restrict network access to the Skype for Business Server to only required IP ranges and ports
• Consider placing the Skype for Business Server in a DMZ with limited access to internal resources until patching is complete

# Example: Windows Firewall rule to restrict outbound connections from Skype for Business Server
# Block outbound connections to internal network ranges (adjust IP ranges as needed)
netsh advfirewall firewall add rule name="Block SSRF to Internal" dir=out action=block remoteip=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 program="%ProgramFiles%\Skype for Business Server\*"