CVE-2023-32541
📋 TL;DR
A use-after-free vulnerability in Hancom Office 2020 HWord's footerr functionality allows attackers to execute arbitrary code by tricking users into opening a specially crafted .doc file. This affects users of Hancom Office 2020 HWord who open untrusted documents. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Hancom Office 2020 HWord
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to full system compromise, data theft, and lateral movement.
Likely Case
Arbitrary code execution in the context of the current user, potentially leading to malware installation, data exfiltration, or ransomware deployment.
If Mitigated
Application crash (denial of service) if exploit fails or memory protections prevent code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Hancom Office updates or vendor advisory
Vendor Advisory: https://www.hancom.com/cs_center/securityNotice.do
Restart Required: Yes
Instructions:
1. Open Hancom Office
2. Navigate to Help > Check for Updates
3. Install all available updates
4. Restart computer
🔧 Temporary Workarounds
Disable .doc file association
windowsPrevent HWord from automatically opening .doc files
Windows: Control Panel > Default Programs > Associate a file type > Select .doc > Change program > Choose different application
Use Microsoft Office for .doc files
allTemporarily use alternative software for .doc files
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Use email/web filtering to block .doc attachments from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Hancom Office HWord version in Help > AboutCheck Version:
On Windows: wmic product where name="Hancom Office HWord" get versionVerify Fix Applied:
Verify version is updated beyond 11.0.0.7520 and test with known safe .doc files📡 Detection & Monitoring
Log Indicators:
- Application crashes of HWord.exe
- Unusual process spawning from HWord
- Memory access violation errors
Network Indicators:
- Unexpected outbound connections from HWord process
- DNS requests to suspicious domains after file open
SIEM Query:
process_name:HWord.exe AND (event_id:1000 OR event_id:1001)