CVE-2024-21379: Microsoft Word RCE Vulnerability

CVE-2024-21379 Overview

CVE-2024-21379 is a remote code execution vulnerability affecting Microsoft Word and related Office products. This vulnerability allows an attacker to execute arbitrary code on a victim's system when a specially crafted document is opened. The attack requires user interaction, where the victim must open a malicious file, but once triggered, it can lead to complete system compromise with the same privileges as the user.

Critical Impact

Successful exploitation of this vulnerability enables attackers to execute arbitrary code with the privileges of the current user, potentially leading to full system compromise, data theft, and lateral movement within corporate networks.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Microsoft Office Long Term Servicing Channel 2021
• Microsoft Word 2016

Discovery Timeline

• February 13, 2024 - CVE-2024-21379 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21379

Vulnerability Analysis

This remote code execution vulnerability in Microsoft Word stems from an integer overflow weakness (CWE-190). Integer overflow vulnerabilities occur when arithmetic operations produce values that exceed the maximum size of the data type used to store them, causing the value to wrap around or truncate unexpectedly. In the context of Microsoft Word's document processing, this can lead to improper memory allocation or buffer sizing, ultimately enabling code execution.

The local attack vector means the malicious payload must be delivered to and executed on the target system, typically through a crafted Word document sent via email, shared through file sharing services, or hosted on compromised websites. The vulnerability does not require elevated privileges to exploit, but it does require user interaction—specifically, the victim must open the malicious document.

Root Cause

The root cause of CVE-2024-21379 is an integer overflow condition (CWE-190) in Microsoft Word's document parsing routines. When processing certain document elements, Word performs arithmetic calculations that can overflow, leading to incorrect memory allocations. This creates a condition where subsequent operations write data beyond the boundaries of allocated buffers, corrupting memory structures and enabling arbitrary code execution.

Attack Vector

The attack vector for CVE-2024-21379 is local, requiring the attacker to deliver a specially crafted Word document to the victim. Common delivery methods include:

1. Phishing emails containing malicious Word document attachments
2. Compromised file shares or cloud storage services hosting weaponized documents
3. Malicious websites serving documents through drive-by download attacks
4. USB drives or other removable media containing the exploit document

When the victim opens the malicious document, the integer overflow is triggered during document parsing, leading to memory corruption and ultimately arbitrary code execution with the user's privileges.

The vulnerability mechanism involves document parsing operations that perform arithmetic calculations on document structure sizes. When these calculations overflow, memory allocation functions receive incorrect size values, creating exploitable buffer conditions. Attackers can craft document structures that precisely control this overflow to achieve reliable code execution. For detailed technical information, refer to the Microsoft Security Update CVE-2024-21379.

Detection Methods for CVE-2024-21379

Indicators of Compromise

• Unusual Microsoft Word process behavior, including unexpected child processes spawned by WINWORD.EXE
• Word documents with anomalous internal structures or embedded objects from untrusted sources
• Memory access violations or crashes in Word following document opens
• Network connections initiated by Word processes to unknown external hosts

Detection Strategies

• Monitor for suspicious process creation events where WINWORD.EXE spawns unexpected child processes such as cmd.exe, powershell.exe, or mshta.exe
• Implement behavioral detection rules for Office applications attempting to execute scripts or connect to suspicious network endpoints
• Deploy endpoint detection and response (EDR) solutions capable of identifying memory corruption exploitation patterns
• Use email security gateways to scan and sandbox Word document attachments before delivery to users

Monitoring Recommendations

• Enable enhanced logging for Microsoft Office applications including process creation and DLL loading events
• Monitor for abnormal memory allocation patterns in Word processes through endpoint telemetry
• Track file system activity for newly created or modified documents in temporary directories following Word execution
• Implement user behavior analytics to identify users opening documents from unusual or suspicious sources

How to Mitigate CVE-2024-21379

Immediate Actions Required

• Apply the latest Microsoft security updates to all affected Office products immediately
• Enable Protected View for documents originating from the internet, email attachments, and other potentially unsafe locations
• Educate users about the risks of opening Word documents from untrusted sources
• Consider implementing application control policies to restrict Office macro execution

Patch Information

Microsoft has released security updates to address CVE-2024-21379 as part of their February 2024 security release. Organizations should apply the appropriate patches for their installed Office versions:

• Microsoft 365 Apps for Enterprise: Update through Microsoft Update or Microsoft Endpoint Configuration Manager
• Microsoft Office 2019: Apply the security update from Microsoft Update
• Microsoft Office LTSC 2021: Apply the security update from Microsoft Update
• Microsoft Word 2016: Apply the security update from Microsoft Update

For complete patch details and download links, refer to the Microsoft Security Update Guide for CVE-2024-21379.

Workarounds

• Enable Protected View for all external documents to prevent automatic code execution when opening untrusted files
• Configure Microsoft Office to block documents containing macros or active content from untrusted sources
• Use Microsoft Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
• Implement strict email filtering policies to quarantine suspicious Word document attachments for analysis

# Configure Office Protected View via Group Policy
# Enable Protected View for files originating from the Internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f

# Enable Protected View for attachments from Outlook
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f

# Enable Protected View for files in unsafe locations
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f