CVE-2024-21435: Windows 11 22h2 OLE RCE Vulnerability

CVE-2024-21435 Overview

CVE-2024-21435 is a remote code execution vulnerability in the Windows Object Linking and Embedding (OLE) subsystem. The flaw affects Microsoft Windows 11 22H2 and 23H2 on both x64 and ARM64 architectures. Microsoft addressed the issue in its March 2024 security update cycle.

The weakness maps to [CWE-426: Untrusted Search Path]. An attacker who convinces a user to open a crafted document or file can execute arbitrary code in the context of the current user. Successful exploitation grants high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code on affected Windows 11 systems through a user-initiated action against a malicious OLE object.

Affected Products

Microsoft Windows 11 22H2 (x64 and ARM64)
Microsoft Windows 11 23H2 (x64 and ARM64)
Applications relying on the Windows OLE component on the above platforms

Discovery Timeline

2024-03-12 - CVE-2024-21435 published to NVD and addressed in Microsoft's security update
2024-12-27 - Last updated in NVD database

Technical Details for CVE-2024-21435

Vulnerability Analysis

The vulnerability resides in the Windows OLE component, which handles linking and embedding of objects across applications. OLE allows content from one application to be inserted into and processed by another, including ActiveX controls, document objects, and compound files.

The weakness is classified under [CWE-426: Untrusted Search Path]. The OLE subsystem can be coerced into resolving and loading a resource from a location an attacker controls. When the targeted user opens a crafted file or interacts with a malicious object, the resolved code executes with the user's privileges.

The attack requires user interaction, but no prior authentication or privileges are needed on the target. Exploitation occurs over the network, typically through a malicious document delivered via email, web download, or file share.

Root Cause

The root cause is improper validation of the search path used by OLE when locating a referenced component or library. An attacker can place a malicious binary in a location consulted by the search routine, causing the OLE runtime to load attacker-controlled code instead of the intended legitimate component.

Attack Vector

The attack vector is network-based with required user interaction. A typical attack chain involves an attacker hosting a crafted document or container that references an OLE object. When the victim opens the file from email, a network share, or a downloaded archive, the OLE subsystem resolves the embedded reference and executes attacker-supplied code in the user's session.

Technical details for proof-of-concept code are not publicly available. See the Microsoft Security Update Guide for the vendor advisory.

Detection Methods for CVE-2024-21435

Indicators of Compromise

Unexpected DLLs loaded by Office or other OLE-consuming processes from user-writable directories such as %TEMP%, %APPDATA%, or Downloads.
Child processes (for example cmd.exe, powershell.exe, rundll32.exe) spawned by winword.exe, excel.exe, outlook.exe, or explorer.exe shortly after a document is opened.
Outbound network connections from Office processes to previously unseen domains following file open events.

Detection Strategies

Hunt for OLE-bearing files (.doc, .xls, .rtf, .docx, .xlsx) executing or referencing binaries from non-standard paths.
Monitor module load events (Sysmon Event ID 7) for OLE host processes loading unsigned or recently created DLLs.
Correlate file write events in user-writable directories with subsequent loads by ole32.dll or oleaut32.dll consumers.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from creating executable content.
Forward Sysmon process creation, image load, and file creation events to a centralized analytics platform for retroactive hunting.
Track Windows 11 build numbers across the fleet to identify endpoints missing the March 2024 cumulative update.

How to Mitigate CVE-2024-21435

Immediate Actions Required

Apply the March 2024 Microsoft security updates for Windows 11 22H2 and 23H2 on all affected x64 and ARM64 systems.
Prioritize patching endpoints that handle untrusted documents, including user workstations and email gateways.
Block inbound delivery of high-risk OLE-bearing file types at email and web proxies until patches are deployed.

Patch Information

Microsoft released a security update addressing CVE-2024-21435. Refer to the Microsoft Security Update Guide for the specific KB articles applicable to Windows 11 22H2 and 23H2. Install the cumulative update through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Enforce Protected View and Office Block macros from the Internet policies to limit OLE invocation from untrusted sources.
Restrict write access to directories on the OLE search path and remove world-writable entries from PATH.
Apply Microsoft Defender ASR rule Block Office applications from creating child processes to disrupt common post-exploitation paths.

bash

# Verify the installed Windows 11 build to confirm the March 2024 update is applied
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled