PoC exploit for recently patched Microsoft Word RCE is public (CVE-2023-21716)

A PoC exploit for CVE-2023-21716, a critical RCE vulnerability in Microsoft Word that can be exploited when the user previews a specially crafted RTF document, is now publicly available.

Patches for the flaw – which affects a wide variety of MS Office and SharePoint versions, Microsoft 365 Apps for Enterprise and other products – have been released by Microsoft last month.

CVE-2023-21716 and the PoC exploit

CVE-2023-21716 was discovered and privately disclosed by security researcher Joshua J. Drake in November 2022.

It is a heap corruption vulnerability in Microsoft Word’s RTF parser that, if triggered, allows attackers to achieve remote code execution with the privileges of the victim. The flaw does not require prior authentication: attackers can simply send a booby-trapped RTF file to the victim(s) via email.

“Microsoft Office 2010 and later use Protected View to limit damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests and thus an additional sandbox escape vulnerability would be required to gain full privileges,” Drake noted in the advisory/report he sent to Microsoft (and has now published).

The report also includes a proof-of-concept PoC (a Python script) that can be used to create a file that will trigger the vulnerability.

In the security advisory accompanying the patches, Microsoft confirmed the Preview Pane as an attack vector. Though patching vulnerable products is preferred, the company also offered guidance possible workarounds, which include:

• Configuring Microsoft Outlook to read all standard mail in plain text format
• Using Microsoft Office File Block policy to prevent Office from opening RTF documents from unknown or untrusted sources.