CVE-2023-34366
📋 TL;DR
This is a use-after-free vulnerability in Ichitaro 2023's Figure stream parser that allows arbitrary code execution when a user opens a malicious document. Attackers can exploit this to gain control of affected systems. Users of Ichitaro 2023 who open untrusted documents are at risk.
💻 Affected Systems
- Ichitaro 2023
📦 What is this software?
Easy Postcard Max by Justsystems
Ichitaro 2021 by Justsystems
Ichitaro 2022 by Justsystems
Ichitaro 2023 by Justsystems
Ichitaro Pro 3 by Justsystems
Ichitaro Pro 4 by Justsystems
Ichitaro Pro 5 by Justsystems
Just Government 3 by Justsystems
Just Government 4 by Justsystems
Just Government 5 by Justsystems
Just Office 3 by Justsystems
Just Office 4 by Justsystems
Just Office 5 by Justsystems
Just Police 3 by Justsystems
Just Police 4 by Justsystems
Just Police 5 by Justsystems
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges and persistent access to the victim's machine and network.
Likely Case
Local privilege escalation leading to data theft, ransomware deployment, or lateral movement within the network.
If Mitigated
Limited impact with application crash or denial of service if exploit fails or is blocked by security controls.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of memory corruption techniques. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version from vendor
Vendor Advisory: https://jvn.jp/en/jp/JVN28846531/index.html
Restart Required: Yes
Instructions:
1. Open Ichitaro 2023. 2. Navigate to Help > Check for Updates. 3. Follow prompts to download and install latest version. 4. Restart application and system if required.
🔧 Temporary Workarounds
Disable Figure Stream Parsing
windowsModify registry to disable vulnerable parsing functionality
reg add "HKCU\Software\JustSystems\Ichitaro\2023" /v DisableFigureParsing /t REG_DWORD /d 1 /f
Restrict Document Opening
allConfigure application to only open trusted documents from specific locations
🧯 If You Can't Patch
- Implement application whitelisting to block Ichitaro execution
- Use email/web gateways to block suspicious document attachments
🔍 How to Verify
Check if Vulnerable:
Check Ichitaro version: Open Ichitaro > Help > About. If version is 1.0.1.59372, system is vulnerable.Check Version:
wmic product where name="Ichitaro 2023" get versionVerify Fix Applied:
Verify version is updated to newer than 1.0.1.59372 and test opening known safe documents.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual process creation from Ichitaro.exe
Network Indicators:
- Outbound connections from Ichitaro process to unknown IPs
SIEM Query:
source="windows" AND (process_name="Ichitaro.exe" AND (event_id=1000 OR event_id=1001))