一、漏洞概述
|
CVE ID
|
CVE-2023-29324
|
发现时间
|
2023-05-10
|
|
类 型
|
安全功能绕过
|
等 级
|
中危
|
|
攻击向量
|
网络
|
所需权限
|
无
|
|
攻击复杂度
|
低
|
用户交互
|
无
|
|
PoC/EXP
|
未公开
|
在野利用
|
否
|
Trident（又称MSHTML）是微软公司为Microsoft Windows版本的Internet Explorer开发的专有浏览器引擎。
5月11日，启明星辰VSRC监测到Windows MSHTML平台安全功能绕过漏洞（CVE-2023-29324）的漏洞细节在互联网上公开。该漏洞的CVSS评分为6.5，微软已在5月9日发布的补丁中修复了该漏洞。
该漏洞为微软3月补丁日中修复的Microsoft Outlook权限提升漏洞（CVE-2023-23397）的补丁绕过，该漏洞源于Windows 中路径的复杂处理，未经身份验证的威胁者可以利用该漏洞强制Outlook 客户端连接到威胁者控制的服务器，可能导致 NTLM 凭据泄露。
二、影响范围
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2016 (Server Core installation)
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for x64-based Systems
Windows Server 2022 (Server Core installation)
Windows Server 2019 (Server Core installation)
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
三、安全措施
3.1 升级版本
微软已经发布了CVE-2023-23397 和 CVE-2023-29324的安全更新，受影响用户需安装这两个漏洞的补丁才能受到全面保护，微软建议安装仅安全更新的用户安装针对该漏洞的IE累积更新，以修复MSHTML平台和脚本引擎中的漏洞。
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29324
3.2 临时措施
3.3 通用建议
定期更新系统补丁，减少系统漏洞，提升服务器的安全性。
加强系统和网络的访问控制，修改防火墙策略，关闭非必要的应用端口或服务，减少将危险服务（如SSH、RDP等）暴露到公网，减少攻击面。
加强系统用户和权限管理，启用多因素认证机制和最小权限原则，用户和软件权限应保持在最低限度。
3.4 参考链接
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29324
https://www.akamai.com/blog/security-research/important-outlook-vulnerability-bypass-windows-api
https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-bypass-for-recently-fixed-outlook-zero-click-bug/
原文始发于微信公众号（维他命安全）：【漏洞通告】Windows MSHTML Platform安全功能绕过漏洞（CVE-2023-29324）
评论