A new attack chain campaign has been discovered, which involves the exploitation of CVE-2023-36884 and CVE-2023-36584. CVE-2023-36884 was a remote code execution vulnerability, and CVE-2023-36584 was a security bypass vulnerability that can be used to exploit CVE-2023-36884.
CVE-2023-36884 was given a severity rating of 8.8 (High), and CVE-2023-36584’s severity rating was 5.4 (Medium). However, the threat actor attributed to the exploit chain was a pro-Russian APT group known as Storm-0978 aka RomCom Group.
In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway
Windows Search RCE Flaw
As part of the initial attack chain, a .docx file was found that was not tagged as MotW (Mark of the Web), leading to the “protected view” being disabled when opening the document.
An MS-DOCX file is a compressed ZIP archive file that consists of an XML file at word/document.xml and consists of the document’s text and formatting.
However, the document.xml file consists of an anchor for imported external content element altchunk which imports an RTF content. This RTF file afchunk.rtf contains two malicious Object Linking and Embedding (OLE) objects.
First Stage of the Exploit Chain
The malicious OLE objects in afchunk.rtf requests content from two URLs,
- \104.234.239[.]26share1MSHTML_C7file001.url
- hxxp://74.50.94[.]156/MSHTML_C7/start.xml
If the victim hosts accesses \104.234.239[.]26share1MSHTML_C7file001.url, the victim’s NTLM credentials, which contain the hostname and username, leaked to the threat actor-controlled SMB server. However, the URLs present two files: file001.url and file001.htm.
Abusing the Windows Search Handler
The file001.htm has a JS that uses iframes to load multiple files. The first filename consists of the victim’s IP address and five five-digit identifier that ends with file001.search-ms. Following this, three HTTP requests using the string .zip_k* in the URLs are made.
New MotW Bypass – CVE-2023-36584
Windows search scans for extensions of each file to determine the contents. When it finds internet files, it writes the file to a temporary directory and adds MotW to it. This operation has a race condition that can be exploited to bypass the MitW.
There were three techniques that were related to Server Side ZIP Swap (Metadata TOCTOU), Server Side Delay (Close Operation) and Server Side Delay (Read Operation).
This technique is exploitable when the ZIP archive is downloaded from a remote server. The zipfldr.dll file reads the ZIP file’s header and caches the data in memory.
Once the file header is read, the ZIP with MotW can be replaced with a legitimate file name using the TOCTOU condition, bypassing the MotW to the file.
Server Side Delay – Close Operation
This technique is associated with the Zone. Identifier ADS, which can be provided with a time delay using a SMB server. This technique was possible due to the SMB2 protocol’s close operation, which contains a close request and a close response.
Server Side Delay – Read Operation
Windows reads a portion of large files that are from a remote share. If there is random data at the end of the file, the writing of the file can be delayed from the SMB server before Windows adds MotW to the file.
The file is usable during the writing process as it is opened with read/write dwShareMode.
A complete report about the attack chain has been published by Palo Alto, which provides detailed information about exploitation techniques, methods of operation, and other information.
Indicators of Compromise
Read: SHA256 hash – Filename
- a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f – Overview_of_UWCs_UkraineInNATO_campaign.docx
- 0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d – word/document.xml
- b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37 – word/_rels/document.xml.rels
- e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539 – afchunk.rtf
- 3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43 – file001.url
- 48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90 – start.xml
- bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856 – file001.zip
- c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3 – 2222.chm
- f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855 – 1111.htm
- cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914 – RFile.asp
- fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a – file001.htm
- 4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d – redir_obj.htm
- 0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f – file1.htm
- 7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be – file1.mht
- 20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7 – fileH.htm
- ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a – fileH.mht
- c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d – ex001.url
The following network paths referenced in this research are associated with the July 2023 lure:
- \104.234.239[.]26share1MSHTML_C7file001.url
- \104.234.239[.]26share1MSHTML_C7ex001.url
- file[:]//104.234.239[.]26/share1/MSHTML_C7/1/
- file[:]//104.234.239[.]26/share1/MSHTML_C7/ex001.zip/file001.vbs
- hxxp://74.50.94[.]156/MSHTML_C7/start.xml
- hxxp://74.50.94[.]156/MSHTML_C7/zip_k.asp?d=
- hxxp://74.50.94[.]156/MSHTML_C7/zip_k2.asp?d=
- hxxp://74.50.94[.]156/MSHTML_C7/zip_k3.asp?d=
- hxxps://www.ukrainianworldcongress[.]info/sites/default/files/document/forms/2023/Overview_of_UWCs_UkraineInNATO_campaign.docx
Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.