CVE-2024-20673: Microsoft Excel RCE Vulnerability

CVE-2024-20673 Overview

CVE-2024-20673 is a Remote Code Execution vulnerability affecting multiple Microsoft Office products. This vulnerability allows attackers to execute arbitrary code on vulnerable systems when a user opens a specially crafted malicious document. The vulnerability requires user interaction, as the victim must open a malicious file for exploitation to occur.

Critical Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise if the user has administrative privileges.

Affected Products

• Microsoft Excel 2016
• Microsoft Office 2016, 2019 (Click-to-Run), and 2021 LTSC
• Microsoft PowerPoint 2016
• Microsoft Publisher 2016
• Microsoft Skype for Business 2016
• Microsoft Visio 2016
• Microsoft Word 2016

Discovery Timeline

• 2024-02-13 - CVE-2024-20673 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-20673

Vulnerability Analysis

This Microsoft Office Remote Code Execution vulnerability is classified under CWE-693 (Protection Mechanism Failure). The vulnerability exists due to improper handling of certain elements within Office documents, which can be exploited by attackers to bypass security mechanisms and execute malicious code.

The attack requires local access to the system, meaning the attacker must somehow deliver a malicious document to the victim's machine. The most common delivery methods include email attachments, malicious downloads, or compromised file shares. Once the victim opens the malicious document, the vulnerability can be triggered without requiring elevated privileges from the attacker.

The exploitation does not require any authentication, but does require user interaction—specifically, the user must open a crafted document. Upon successful exploitation, an attacker gains the ability to execute code with full confidentiality, integrity, and availability impact within the context of the current user's session.

Root Cause

The vulnerability stems from a protection mechanism failure (CWE-693) within Microsoft Office's document processing components. This indicates that security controls intended to prevent code execution from untrusted document content can be circumvented. The failure allows specially crafted documents to bypass intended security boundaries and execute arbitrary code.

Attack Vector

The attack vector for CVE-2024-20673 is local, requiring the attacker to convince a user to open a malicious document. Common attack scenarios include:

1. Phishing campaigns - Sending malicious Office documents via email disguised as legitimate business communications
2. Watering hole attacks - Hosting malicious documents on compromised websites frequented by target users
3. Supply chain attacks - Embedding malicious documents within legitimate software packages or updates
4. Social engineering - Convincing users to download and open documents from untrusted sources

The vulnerability affects the core Office suite components, meaning any application capable of processing the vulnerable document types could trigger the exploit.

Detection Methods for CVE-2024-20673

Indicators of Compromise

• Suspicious Office processes spawning unexpected child processes such as cmd.exe, powershell.exe, or wscript.exe
• Office applications making unusual network connections immediately after opening documents
• Unexpected file system modifications by Office processes outside normal document directories
• Anomalous memory allocation patterns within Office application processes

Detection Strategies

• Monitor for Office applications spawning command interpreters or script hosts using endpoint detection and response (EDR) solutions
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Deploy email security solutions capable of scanning and sandboxing Office document attachments
• Enable Microsoft Defender Attack Surface Reduction (ASR) rules for Office applications

Monitoring Recommendations

• Configure logging for process creation events (Windows Event ID 4688) with command line auditing enabled
• Monitor Office application behavior using SentinelOne's behavioral AI engine for anomalous document handling
• Implement network traffic analysis to detect command and control communications following document opening
• Review Windows Event logs for suspicious Office-related activity patterns

How to Mitigate CVE-2024-20673

Immediate Actions Required

• Apply Microsoft security updates released in February 2024 for all affected Office products immediately
• Enable Protected View for Office documents from untrusted sources
• Implement Microsoft Defender Application Guard for Office where supported
• Educate users about the risks of opening Office documents from unknown or untrusted sources

Patch Information

Microsoft has released security updates addressing CVE-2024-20673 as part of their February 2024 security updates. Organizations should apply the appropriate patches for their Office installations through Windows Update, Microsoft Update Catalog, or their enterprise patch management solution.

For detailed patch information and download links, refer to the Microsoft Security Update Guide for CVE-2024-20673.

Workarounds

• Enable Protected View for all Office documents by configuring Trust Center settings to open files from the Internet and other potentially unsafe locations in Protected View
• Implement application whitelisting to prevent unauthorized code execution from Office processes
• Configure Office to disable macros and active content by default using Group Policy
• Use Microsoft Office sandbox features and ensure documents from external sources are opened in isolation

# Group Policy Configuration for Protected View
# Navigate to: User Configuration > Administrative Templates > Microsoft Office > Security Settings
# Enable: "Protected View - Block macros from running in Office files from the Internet"
# Enable: "Protected View - Turn on Protected View for files originating from the Internet"